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SECTION 1 


INTRODUCTION 


Recently, there has been much interest in the problem of restruc- 
turing the control law of aircraft following the failure of control sur- 
faces or actuators (References 1,2,3). This interest is motivated in 
part by two incidents involving commercial aircraft. In the case of 
Delta flight 1080 on April 12, 1977, the left elevator became stuck in 
the 19° up position at takeoff (Reference 4). The pilot was able to com- 
pensate for the failure, in part by manipulating thrust to control the 
pitch axis. However, the pilot of the DC10 that crashed in Chicago 
(Reference 5) was unable to recover from the left engine breaking loose 
and the resulting retraction of the left wing's outboard leading edge 
slats. Simulations indicate that the aircraft could have been flown if 
impending stall conditions had been recognized and the proper corrective 
action taken. Restructuring the control system on-line to counteract the 
effect of these failures may be one solution to such problem situations. 
Although the need for restructurable control has been demonstrated for 
state-of-the-art aircraft systems, it can be expected to be most applica- 
ble to future aircraft where redundant control surfaces will very likely 
be extensively employed. 

A feasible and practical restructurable control system requires 
the correct and timely detection and isolation of the control surface 
failure so that the proper corrective action can be taken. The Charles 
Stark Draper Laboratory, Inc. (CSDL) has investigated and evaluated prac- 
tical FDI techniques for the NASA Langley Research Center under contract 
NASI -17556 entitled, "Evaluation of Failure Detection and Identification 
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Techniques for Application in Aircraft Res true turable Control Systems.” 
Reference 6 and this report document the results of this contractual 
effort. 

The initial phase of the CSDL study, Reference 6, compared three 
failure detection and isolation techniques for detecting and isolating 
control surface or actuator failures: the detection filter, the general- 
ized likelihood ratio (GLR) test, and the orthogonal series generalized 
likelihood ratio ( OS GLR) test. A modification to the basic detection 
filter was also considered. The algorithms were evaluated by testing 
their ability to detect and isolate control surface failures in a non- 
linear simulation of a C-1 30 aircraft. The testing was in general limit- 
ed to a single cruise operating condition. All the algorithms were cap- 
able of detecting failures. However isolating aileron and flap failures 
was difficult since these surfaces produce similar effects on the air- 
craft. Since the algorithms had difficulty isolating wing surface fail- 
ures, the system monitoring strategy for implementing the FDI algorithms 
would augment the FDI algorithm with position measurements of these sur- 
faces • 


The detection filter (References 7,8,9) has the form of an observ- 
er with the feedback gain matrix chosen so that each type of failure pro- 
duces a uniquely defined residual. With direct input-output coupling re- 
sulting from the use of acceleration measurements, the residuals produced 
by control surface failures may only be constrained to a known plane. 

The modification to the basic detection filter uses secondary filtering 
of the residuals to produce unidirectional control surface failure signa- 
tures with acceleration measurements. 

The GLR and OSGLR algorithms (References 10 and 11 respectively) 
are sequential hypothesis tests. The failure hypothesis for the GLR al- 
gorithm assumes an additive failure of a known behavior or, equivalently, 
failure mode with unknown onset time and unknown magnitude. The failure 
mode assumed for this study was a step. Based on the residuals from the 
Kalman filter designed for the no-failure system, the maximum likelihood 


- 2 - 



estimate of the failure magnitude is determined for each possible failure 
onset time. Using this estimate of the failure magnitude, the likelihood 
ratio is maximized over the possible onset times to produce the general- 
ized likelihood ratio test statistic. 

Instead of assuming a fixed failure mode, the OSGLR algorithm ex- 
presses the failure mode as a truncated series of orthonormal basis func- 
tions. Based on the residuals of a no-failure Kalman filter, the coeffi- 
cients of the series expansion are estimated using maximum likelihood es- 
timation and a generalized likelihood ratio is formed using these esti- 
mates. The rationale for adopting this approach is that most failures 
should be represented fairly well using a truncated orthogonal series ex- 
pansion and this algorithm should be more robust to failure mode uncer- 
tainty than the conventional GLR test. Unlike the GLR algorithm, the on- 
set time of the failure does not need to be estimated and therefore the 
algorithm is computationally more efficient. 

The OSGLR algorithm provided the best detection and isolation per- 
formance. The disadvantage of the OSGLR algorithm is its robustness to 

modeling errors was worse than the other algorithms. The GLR algorithm 

performed almost as well as the OSGLR algorithm. However, the computa- 
tional burden of the GLR algorithm is very heavy and it is not robust to 
failure mode uncertainty. The OSGLR and GLR algorithms were less sensi- 
tive to severe turbulence than the basic and modified detection filter 

algorithms because the turbulence model was incorporated into the no- 
failure Kalman filter. The sensitivity of the detection filter algo- 
rithms to turbulence degraded their detection performance relative to the 
OSGLR and GLR algorithms. The advantage of the detection filter algo- 
rithms is their relatively low computational processing. Based on this 
comparison, the OSGLR algorithm was selected for further study as the 
most promising of the algorithms. 

This report focuses on an in-depth evaluation of the OSGLR algo- 
rithm. This evaluation considers a variety of steady winds and wind tur- 
bulence levels and a number of flight conditions or flight regimes repre- 
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sentative of the range of environments in which a transport aircraft must 
operate. Detection and false alarm performance issues are also address- 
ed. Sensor dynamics and errors are included in the simulation. 

In addition, to ensure all promising practical FDI techniques have 
been evaluated, the literature is searched for FDI techniques that might 
be applicable to control surface and actuator failure detection and 
isolation in addition to those already studied. Any promising techniques 
are to be included in the detailed evaluation described above. 

This report is organized as follows. Section 2 reviews the ini- 
tial phase of this study and summarizes the results. Section 3 surveys 
the literature for other applicable FDI algorithms. Since the major 
drawback to the OSGLR algorithm is robustness to modeling errors. Section 
4 examines possible methods of reducing the effects of modeling errors on 
the algorithm. The testing at a number of off-nominal flight and wind 
conditions of the algorithm designed using a single cruise linear model 
is described in Section 5. Also a number of failure cases are described 
in order to determine the detection performance of the algorithm. 

Section 6 examines scheduling as a means of extending the algorithm to a 
larger flight envelope. The report is summarized and the major conclu- 
sions presented in Section 7. Appendix A contains a table summarizing 
the test cases presented in this report for easy reference and compari- 
son. Appendix B contains additional implementation details of the sched- 
uling approach. 
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SECTION 2 


BACKGROUND 


2.1 Introduction 

The previous work done on this contract (Reference 6) analyzed and 
compared the feasibility of using three FDI algorithms to detect and iso- 
late aircraft control surface and actuator failures. The three algo- 
rithms were the detection filter, the generalized likelihood ratio (GLR) 
test, and the orthogonal series generalized likelihood ratio (OSGLR) 
test. A modification to the detection filter was also developed and 
tested. In addition, a system monitoring strategy was developed. The 
present effort further investigates the most promising of the FDI 
algorithms evaluated - the OSGLR algorithm. In order to provide the 
necessary background for this effort and to motivate our selection of the 
OSGLR algorithm as the most promising, this section reviews the prelimary 
evaluation of the FDI algorithms and system monitoring strategy described 
in Reference 6. The nonlinear C-1 30 aircraft simulation used in the 
evaluation is described in the next section. A description of the algo- 
rithms evaluated, a comparison of the algorithms, and the selection of 
the system monitoring strategy follows. 

2.2 C-1 30 Simulation Description 

The FDI algorithms were evaluated by testing their ability to de- 
tect and isolate control surface failures that have occurred in a 
simulation of a Lockheed C-1 30 aircraft. The C-1 30 aircraft is a mili- 
tary, medium- to long-range transport propelled by four turboprop engines 
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located on a high wing. The particular version of the 0130 aircraft 
used for this program has short takeoff and landing (STOL) capability 
provided by trailing edge double-slotted flaps. 

The simulation of the 0130 aircraft uses the standard six 
degree-of -freedom aircraft nonlinear equations of motion. The aerody- 
namic forces and moments are described by one-, two-, or three-dimen- 
sional look-up tables. These look-up tables are functions of angle of 
attack, sideslip angle, thrust, and the control surface deflections. 

Each of the four engines are assumed to provide the same thrust. 

Actuator dynamics have been included; however, sensor dynamics were not 
included. 

The surfaces available for control of the aircraft are the 
ailerons, flaps, rudder and elevator. The simulation allows for indepen- 
dent motion of the left and right ailerons and the left and right flaps. 
Since aileron and flap failures are similar in their effect on the 
dynamics of the vehicle, detecting and isolating aileron and flap 
failures provided an adequate test for the algorithms that were 
evaluated. 

The eleven measurements available for detecting and isolating 
failures are those typically available onboard aircraft. These measure- 
ments are listed in Table 2,1 , along with the six control inputs describ- 
ed above and the ten states that describe the aircraft dynamics. The 
measurements are generated in the simulation by superimposing zero-mean 
Gaussian distributed noise on the output variables. The noise statistics 
used for this study are shown in Table 2.2, 

Wind turbulence is also incorporated in the simulation. The tur- 
bulence velocity along each body axis is modeled by passing white noise 
through shaping filters to produce signals with desired one-dimensional 
power spectral densities. The Dryden form of the spectra, defined in 
Reference 12, is modeled. The turbulence intensities used in the pre- 
liminary evaluation are presented later in this section. The turbulence 
scale lengths were the clear air values defined in Section 3 ,7 ,3. 2 of 
Reference 12. 
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Table 2*1. Inputs, Outputs, and States of the 0130 Aircraft 


Inputs 

Elevator 
Right aileron 
Left aileron 
Right flap 
Left flap 
Rudder 

Outputs 

Airspeed 

Acceleration at the eg along the y body axis 
Acceleration at the eg along the z body axis 
Angular velocity about the x body axis 

Angular velocity about the y body axis 

Angular velocity about the z body axis 

Roll 
Pitch 
Yaw 

Altitude rate 
Altitude 

States 

Airspeed 
Sideslip angle 
Angle of attack 

Angular velocity about the x body axis 

Angular velocity about the y body axis 

Angular velocity about the z body axis 

Roll 

Pitch 

Yaw 

Altitude 
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Table 2.2. Standard Deviation of Sensor Noise 


SENSOR 

STANDARD DEVIATION 

Airspeed 

3.35 m/s 

11 ft/s 

Accelerometers 

•3 m/s^ 

.98 ft/s 2 

Roll Rate Gyro 

.0024 rad/s 

.1375 deg/s 

Pitch and Yaw Rate Gyros 

.0007 rad/s 

.04 deg/s 

Attitude Gyros 

.01 radians 

.573 degrees 

Altitude Rate 

.08 m/s 

.25 ft/s 

Altitude 

3.05 m 

10 ft 
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2.3 Description of FDI Algorithms Evaluated 


The three FDI algorithms considered, the detection filter, the gen- 
eralized likelihood ratio test, and the orthogonal series generalized 
likelihood ratio test, are described in this section. A modification to 
the detection filter was also developed and tested. The modification 
will be referred to as the modified detection filter and will be discuss- 
ed as a separate algorithm. 

2.3.1 The Detection Filter 1 

The detection filter (References 7,8,9) is a linear, time-invariant 
observer of the system (see Figure 2.1). Therefore, the nonlinear system 
excluding the actuator dynamics must be linearized about a nominal oper- 
ating condition for use in the observer. The model can be expressed as 


x(t) 

= Ax( t) 

+ Bu( t) 

(2.1 ) 

y(t) 

= Cx( t) 

+ Du(t) 

(2.2) 


where x(t), u(t), and y(t) are the deviations in the states, controls, 
and outputs respectively from their nominal values. The superscript 
tilde in Figure 2.1 denotes the actual nonlinear qualities. Detection 
filter theory cannot account for the effects of disturbances, measure- 
ment noise, or mismodeling. Their effects on the performance of the 
detection filter will be determined via simulation. 

The detection filter state and residual satisfy 

x'(t) = Ax' ( t) + Bu'(t) + Kr( t) (2.3) 

r(t) = y(t) - y' (t) (2.4) 


1 


This description was taken from Reference 


13. 
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where 


y'(t) = Cx'(t) + Du'(t) (2.5) 

Here, the prime denotes the detection filter state, output, and expect- 
ed (no-failure) control input. In the absence of failures, the detec- 
tion filter state estimation error satisfies the differential equation 

q(t) = (A - KC)q(t) (2.6) 

and the residual in terms of the state estimation error is given by 

r(t) = Cq( t) (2.7) 

In the presence of a failure of the ith actuator or control surface, 
the filter error and residual dynamics are given by 


q(t) 

= (A - KC)q(t) + (b ± - Kd ± )n(t) 

(2.8) 

r(t) 

= Cq(t) + d^n(t) 

(2.9) 


where b^ and are the ith columns of the B and D matrices, and n(t) is 
a function of time which represents the failure mode (i.e., the behavior 
of the failed surface relative to the expected behavior). Detection fil- 
ter theory allows n(t) to be any arbitrary function of time. 

Since the gain matrix K must be chosen such that the filter is 
stable, the detection filter will track the system when there are no 
failures. However, when a failure occurs, the actuator models or the 
linear model incorporated into the filter no longer accurately model the 
system, and a nonzero residual results. The objective of detection fil- 
ter design is to constrain the residual produced by a particular failure 
to a single direction or plane. A failure is detected, then, when one or 
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more of the residual projections along a known failure direction or in a 
known failure plane are sufficiently large. Isolating a failure may be 
possible if one of the residual projections is significantly greater than 
the rest. 

Prior to this work, the development of the detection filter assumed 

no direct coupling between the inputs and the outputs (i.e., no D 

matrix) • Without input-output coupling, present design procedures may be 

able to determine K such that the residual is unidirectional in response 

to a control surface or actuator failure. If such a gain matrix exists, 

lc 

the residual will be constrained to the direction CA b. where k is the 

k 

smallest positive integer for which CA b. is nonzero. Since n(t) does 
not affect the failure direction, the failure direction is independent of 
the failure mode. This is an important advantage of the detection 
filter. 

Using acceleration measurements to detect actuator and control sur- 
face failures, however, results in direct input-to-output coupling. In 
this case, the residual produced by such failures may be constrained to a 
plane spanned by the vectors d i and C(b i - Kd.) if the part of the 
residual produced by the (b^ - Kd^)n(t) term can be restricted to a 
single direction. The difficulty in determining a gain matrix K to do 
this is that present design procedures assume the direction of the addi- 
tive term to the filter state error equation is known. However, the 
direction of the (b^ - Kd^)n(t) term is not known until the gain matrix 
is determined. Fortunately, knowledge of this direction is not necessary 
when the system is fully measured (i.e., the rank of C is equal to the 
number of states). The system used in the preliminary evaluation was 
fully measured. 

2.3.2 The Modified Detection Filter 2 

Secondary filtering of the detection filter residual was found to 
restore the unidirectional failure signature property even when there is 
direct coupling between the inputs and the measurements. Assuming that 

2 

This description was taken from Reference 13. 
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the detection filter gain matrix, K, is calculated to satisfy the 
relationship K = A - XI, the transfer function between the residual and 
the unexpected input from the ith actuator is 


C(b. - Kd. ) 

r(s) = [ 1 + d i ] n(s) (2.10) 

If the contribution ^nfs) could be filtered with the same time 

constant as in the detection filter, the failure signature would be 

unidirectional, lying along C(b. - Kd ) + d • 

-x -i -i 

The secondary filtering scheme, then, has several elements. First, 
the components of the residual along the event vectors d. are separated 
from the residual. Next they are filtered using the detection filter 
time constant. Finally, these filtered components are then added to 
the other components, forming a new residual which is used for failure 
detection and isolation. 

In order for the initial separation of the components along d. to be 

possible, all event vectors d^ must be mutually independent, and each 

must be independent of the hyperplane formed by the C(b^ - Kd. ) vectors. 

To obtain the components of the residual in the directions d , first 

-i 

write the residual 



? P£(t) (2.12) 

Here, C(b^ - Kd^) has been normalized for each of the six actuators 
considered in the preliminary evaluation, giving C(b. - Kd. ) , and d 
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and d are the two distinct directions among the columns of the D matrix 
—2N 

resulting from the two acceleration measurements. The vector c(t) is 
obtained using 


c(t) = p + r(t) 


(2.13) 


where P* is the Moore-penrose pseudo inverse of P. 

The magnitudes c^ and c Q are passed through a secondary two-state 
filter: 


q' (t) 


Xlq'(t) + 



(t) 


c 8 (t) 


(2.14) 


Substituting these filtered components for the unfiltered ones in c(t) 
leads to 


c f (t) 


c l (t) 


(2.15) 


C 6 (t) 

q;<t) 

q’(t) 


Transforming this vector of components back into the original residual 
space results in 


r f (t) = Pc f (t) 


(2.16) 
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Actuator failures may be detected and (simultaneously) isolated through 
projection of r f (t) onto each of the six signature vectors 
0(1^ - Kd^ + d i . 

In using the transformation P, rjt) has been assumed to lie, in this 
case, in the eight-dimensional space spanned by columns of P. Applying 
transformations P + and P leads to suppression of noise in the residual 
that is in directions orthogonal to the range of P. Because noise in 
these directions only interferes with failure detection and isolation, 
this suppression could be very beneficial. However, the transformation 
is model-dependent and therefore will be sensitive to modeling errors. 

The modified detection filter is shown in Figure 2.2 

2.3.3 The Generalized Likelihood Ratio ( GLR) Test for 
Dynamic Systems 3 

The GLR test (Reference 10) assumes a linear, time-varying system. 
The discrete— time case will be considered here. In the normal or un— 
failed mode of operation, the state equation and measurement equation 
are given by 

H 0 : 2E.( k+1 ) = $(k)x(k) + B(k)u(k) + w(k) (2.17) 

X^k) = C(k )x^(k ) + D(k)_u(k) + v(k) (2.18) 

where 2£(k) is an n-dimensional state vector, y_(k) is an m-dimensional 
measurement vector, $(k) is the state dynamics matrix, and C(k) is the 
measurement matrix. B(k) and D(k) are the input matrices for state and 
output equations with _u(k) being the control input. w(k) and v(k) are 
zero— mean, independent, Gaussian white processes with intensities Q(k) 
and R(k) , respectively. For the analysis that follows, the effects of 
the control input may be omitted, due to the linearity of the equations. 

3 

This description of the GLR test was partially taken from Reference 6. 
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Figure 2.2 Block diagram of the modified detection filter 













The GLR failure hypothesis is that 


H 1 s x(k+1 ) = $(k)jc(k) + w(k) + b(k)n(k, 0) v (2.19) 

y(k) = C(k)x(k) + v(k) + dU)n(k, 0) v (2.20) 

where b(k) and d^(k) are known vectors that depend on the type of 
the failure. For example, if an actuator failure is modeled, b(k) 
will be the column of the matrix B(k) corresponding to that acuator, 
and d(k) will be the corresponding column of D(k). n(k, 0) is the 
mode shape , or simply mode , of the failure, which occurs at time 0. 
Generally, we have that 


n(k, 0) = 0, k < 0 (2.21 ) 

For example, if a bias failure is assumed, then 


0 k < 0 

n(k, 9) = (2.22) 

1 k > 0 


Finally, v is the magnitude of the failure. 

One of the difficulties with the GLR test is that the failure mode 
is assumed to be known in advance. While specifying the mode of the 
failure will most likely improve the detection performance of a 
failure for that specific mode shape, the detection performance of 
other failure modes probably will be degraded. Adequately enumerating 
all the possible failure modes is a practical consideration which must 
be dealt with. 

Suppose the data jr(k) are observed over the observation interval 

k 0 - k - k f (2.23) 
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For a given time of failure, 9, and magnitude of failure, v, the 
Likelihood Ratio (LR) is given by 


P(yOO, I (k n +1) ' •••' H , 9 , v) 

A(k f , 9, v) = — (2.24) 

p(y(k Q ) ,y(k Q +i ) , ..., yOc f )|H 0 ) 

Because the _y(k) are not independent from time step to time step, the 
evaluation of the conditional probabilities is difficult. To evaluate 
the LR, a Kalman filter is implemented, based on the normal mode (H 0 ) 
system. The filter equations are 

x~ (k+1 ) = $(k)x + (k) (2.25) 

x + (k) = £~ (k) + K(k)j(k) (2.26) 

where K(k) is the Kalman gain matrix, and j^(k) is the residual, given by 

_X(k ) * y(k) - C(k)x~(k) (2.27) 

The Kalman gain matrix is given by 


K(k) = P - (k)C T (k)M _1 (k) 

where P~(k) is the covariance of the estimation error 
e_~(k) = x(k) - x~(k) 

and M(k) is the covariance of j[(k), given by 

M(k) = C(k)p-(k)C T (k) + R(k) 


(2.28) 


(2.29) 


(2.30) 
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The covariance is propagated by 


p"(k+1) = $(k)p + (k) $ T (k) + Q(k) (2.31) 

P + (k) = [I - K(k)C(k) ]P~(k) (2.32) 

The LR may then be written in terms of the residual sequence jy(k) rather 
than the measurement sequence. Because the residual sequence is (condi- 
tionally) a white Gaussian sequence, the LR is easier to determine in 
terms of J£(k) than in terms of yjk) • 

Due to the linearity of the state equation and the filter equa- 
tions, the residual may be expressed under each hypothesis as 

V K k) = j^(k) (2.33) 

« 1 : y(k) = Y^k) +_g(k,0)v (2.34) 

where _Yg(k) is a zero-mean, white Gaussian sequence with covariance 
M(k). jg(k, 0) is the failure signature of a failure occurring at time 0. 
jj(k, 0) is given by 


jj(k,0) « C(k)f_(k, 0) + d(k)n(k,0) (2.35) 

where _f(k, 0) is the influence of the failure mode n(k, 0) on the state 
estimation error. f^k, 0) may be generated recursively by 

f_(k+1,0) » *(k)[i - K(k)C(k)]£(k, 0) + [b(k) - $(k)K(k)d(k) Jn(k, 0) 

(2.36) 

with the initial condition 


f (k Q , 0) = 0 


(2.37) 
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It can be seen therefore that 

f_(k, 0) = _0, k _< 0 (2.38) 

Because the residual sequence is (conditionally) Gaussian and 
white, the Log Likelihood Ratio (LLR) ratio has a particularly simple 
form: 



(2.39) 


(2.40) 


(2.41) 


(2.42) 


(2.43) 


(2.44) 
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As a matter of convenience, the GLR decision function is defined by 

X 2 (k f ,0) 

DF(k f ) = 2 £(k ) = max — (2*45) 

0 S (kf ,0) 

A failure is detected when the decision function exceeds the detection 
threshold. 

A closed-form solution to the above maximization does not exist 
in general. Therefore, in order to implement the GLR, the statistic 
&(kf,0) must be computed for all possible times of failure, 0. As a 
result, a bank of matched filters that grows linearly with time is 
required. To avoid this unlimited growth in the amount of computation, 
the assumed time of failure may be restricted, say, to be in the range 
kf - N < 0 <_ kf • Even so, the amount of computation required to 
implement the GLR can be quite large, especially if N is large. This 
problem arises because the unknown parameter 0 enters the equations in a 
nonlinear fashion. Hence, a nonlinear estimation structure is required 
to estimate 0. This problem is typical of FDI tests in which the onset 
time of the failure appears as an unknown parameter of the failure hypo- 
thesis. 

2.3.4 Orthogonal Series Generalized Likelihod Ratio ( OS GLR) Test 14 

The OS GLR test (Reference 11) is similar in many ways, to the GLR 
test discussed previously. The discrete-time version will be presented 
here. A linear, time-varying system is assumed. The unf ailed system is 
the same as the unfailed system assumed for the GLR test (Eqs. 2.17 and 
2.18). However, the OS GLR failure hypothesis is assumed to have the form 

H -| : = $(k)3c(k) + w(k) + b(k)f(k) (2.46) 

= C(k)ac(k) + v(k) + d_(k)f(k) (2.47) 

This description of the OS GLR test was partially taken from 
Reference 14. 
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where b(k) and d(k) are known vectors that depend on the type of the 
failure, and f(k) is the mode shape, or simply mode, of the failure. 
Because the failure mode is generally not known a^ priori , it would be 
desirable to allow the failure mode f(k) to be completely arbitrary. The 
approach that will be taken here is to represent the mode shape f(k) by a 
truncated series expansion. The motivation is that if the basis func- 
tions of the expansion are chosen properly, it should be possible to ap- 
proximate any well-behaved failure mode. In this sense, the OSGLR test 
is similar to the detection filter which assumes the failure mode to be 
unknown. 

The data is assumed to be observed over the interval Ik ,k 1. A 

L o f J 

constraint is imposed on the form of the series expansion, namely, that 
it has the form 

P 

f(k) = l a (k ) <f> (k -k) (2.48) 

i=1 

where p is the number of basis functions used in the series expansion. 
That is, the series expansion is expressed in terms of basis functions 
which are defined relative to the end of the observation interval, k^. 

Eq. 2.48 may be expressed more conveniently in vector form as 

f(k) = _£ T (k f -k)a_(k f ) (2.49) 


Eqs. 2.46, 2.47, and 2.49 specify the failure hypothesis . 

Note that the left side of Eq. 2.49 is a function only of k, 
whereas the right side is a function of both k and k f . This apparent 
contradiction is resolved by choosing the basis functions and 
coefficients such that the right side of Eq. 2.49 is invariant with 
respect to k f . This requires that a.(k f ) satisfy the difference 
equation 

a/k f +1) = (2.50) 
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where A is a constant matrix* Furthermore, the vector of basis functions 
a 

J>(i) must satisfy the difference equation 

_£<i+1) = A^(i) (2.51) 


where A is a constant matrix and i is a dummy time index defined 


i = k f -k 


That is, i defines a time scale that runs backwards from the end 


of the observation interval, k^. 
related by 


The matrices A and A are 
a 4> 


(2.53) 

The measurement process y(k) over the interval [k Q ,k f ] is used 
to form the likelihood ratio for the hypotheses and . Because 
the measurement process is correlated in time, it is difficult to deter- 
mine the likelihood ratio in terms of y(k). Instead, the data are 
filtered using a Kalman filter based on H Q to produce the residual 
process, j[(k). Because the residual process is white (when no failure 
has occurred), it is more easily used to obtain the likelihood ratio. 

The Kalman filter discrete-time equations are given in the GLR test 
description (Eqs. 2.25 - 2.32). 

Due to the linearity of the state and measurement equations 
and of the Kalman filter, the OSGLR hypotheses may be written as 

V = Io< k ) (2.54) 

H 1 : J£(k) = JqU) + G(k)a(k) (2.55) 
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where J[qOO is a zero-mean, Gaussian white processes with intensity 
M(k). G(k) represents the influence of the coefficient vector a.(k) 
on the residual. The residual influence matrix G(k) is given by 

G(k) = C(k)F(k) + d(k)j, T (0) (2.56) 

where F(k) is the matrix that represents the influence of _a( k) on 
the estimation error. F(k) satisfies the difference equation 

F(k) = {A(k)[l - K(k)C(k) ]F(k) 


+ [b(k) - A(k)K(k)d(k) 1^(0) 



(2.57) 


with initial condition 

F(k ) = 0 


(2.58) 


The information in the residual process may be reduced to a 
sufficient statistic ^(k) that contains all the information in the 
residuals about the two hypotheses (Reference 15). _^(k) satifies the 

difference equation 

£(k+1) = A^(k) + G T (k+1 )M _1 (k+1 )j(k+1 ) (2.59) 

with initial condition 

X (k Q ) = G T (k 0 )M"''(k 0 ) j(k Q ) (2.60) 

Now, ^(k) is a Gaussian random vector, because j^(k) is a Gaussian 
random process. Under H q , the mean of ^(k) is the zero vector. 

The covariance of ^(k) , S(k) , satisfies the difference equation 

S(k+1) = A S(k)AT + G T (k+1)M-1(k+1)G(k+1) (2.61) 

<P <P 
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with initial condition 


S(k Q ) = G T (k 0 )M- 1 (k () )G(k 0 ) (2.62) 

Under , ^_(k) has the same covariance, but its mean is given by 

»[*<*> | H J = S(k)a_(k) (2.63) 

Therefore, the OSGLR hypotheses may be rewritten as 

Hq: ^(k f ) ~ N(0,S(k f )) (2.64) 

H-j s x (k f ) ~ N(S(k f )a(k f ) ,S(k f )) (2.65) 


Finally, the log likelihood ratio for these hypotheses is given by 

£(k f ,a(k f )) = a T (k f ) 1 (k f ) - 1 a T (k f )S(k f )a(k f ) (2.66) 

Because the vector of coefficients a(kf) is unknown, an appro- 
priate test statistic to use is the generalized likelihood ratio. In 
this case, the decision function DF(k) is defined by 

DF(k ) = max 2£(k ,a(k )) 

r ^ i — t 

£(k f ) 

- ^ T (k f )S -1 (kf) x (k f ) (2.67) 

A failure is detected whenever the decision functions exceeds a 
threshold. That is, the detection test is given by 

declare a failure 

DF(k) > T 2 (2.68) 

< 

continue testing 
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2 

where T is the detection threshold. The decision function is 
written with k as the time argument, rather than k^, to emphasize 
the fact that the test is to be implemented as a sequential test, al- 
though it is derived as a fixed-data test. 

Note that the OSGLR test has a relatively simple structure. The 
differential equations for _^(k) and S(k) are simply the Kalman filter 
equations for estimating a.(k) in information form. The state equation 
for a_(k) is given by Eq. 2.50, and the measurement equation is given by 
Eq. 2.55. The only other equation required to implement the OSGLR test 
is the decision function calculation of Eq. 2.68. Hence, the OSGLR test 
is no more difficult to implement than a single Kalman filter of order p. 

In many respects, the OSGLR test is similar to the GLR test. The 
GLR test also employs a Kalman filter to estimate the unknown failure 
magnitude, v. Because v is a constant, and the Kalman filter is imple- 
mented in information form, the resulting estimator is simply a matched 
filter. However, a bank of filters is required, because v must be esti- 
mated for each possible time of failure, 0. Thus, the GLR test may be 
computationally burdensome, especially if the number of possible failure 
times (i.e., the width of the "data window”) is large. 

2.4 Evaluation and Comparison of the FDI Algorithms 

The evaluation and qualitative comparison of the four FDI algo- 
rithms described in Section 2.3 in detecting and isolating control sur- 
face failures is presented here (Reference 6). The evaluation was con- 
ducted as follows. Each algorithm was designed and tested at a single 
flight condition of 1000 ft. altitude and 150 knot airspeed. An addi- 
tional flight condition was tested to determine the effects of modeling 
errors. Only the time-invariant, steady state implementation of the GLR 
and OSGLR algorithms was tested. The assumed failure mode of each GLR 
failure hypothesis was a step function of unknown magnitude occurring at 
time 0. For each OSGLR failure hypothesis, six basis functions were used 
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in the truncated series expansion. The basis functions used were the 
discrete-time equivalent of the Laguerre function with a 3 s time con- 
stant. The GLR and OSGLR algorithms were tested in turbulence of inten- 
sity 1.98 m/s (6.5 ft/s) while the detection filter and the modified de- 
tection filter were tested mostly in turbulence of intensity 0.3 m/s (1 
ft/s) although turbulence intensity of 1.98 m/s (6.5 ft/s) was also 
briefly considered. The Kalman filter, used by both the GLR and OSGLR 
algorithms, incorporated the turbulence model. Bias failures were intro- 
duced into the nonlinear C-130 simulation to test the two detection fil- 
ter algorithms. To test the GLR and OSGLR algorithms, bias failures were 
introduced into a linear simulation of the C-130 aircraft. In addition, 
the nonlinear C-130 simulation was used to determine the effects of non- 
linearities on the GLR and OSGLR algorithms and to test their ability to 
detect ramp and stuck failures. Thresholds were not selected for the two 
detection filter algorithms and a general detection and isolation logic 
was not developed. In spite of these limitations, we believe that a suf- 
ficiently accurate picture of the capabilities of each algorithm was ob- 
tained to allow the algorithms to be qualitatively compared. 

In comparing the four algorithms, the following issues were con- 
sidered: 

• Failure modes (bias, stuck, ramp, etc.) that can be detected 

• Type of failure (rudder, elevator, etc.) that can be detected 
and isolated 

• Magnitude (or degree) of failures that can be detected 

• False alarm performance 

• Detection time (time delay between failure and detection) 

• Computational burden 

• Robustness 

• Maturity 

Each issue will now be individually addressed. 
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2.4.1 Failure Modes 


Failure modes describe the behavior of the failed surface. Some 
of the important failure modes for res true turable control applications 
are stuck, hardover, and bias failures and the loss of part or all of a 
surface. The ability of the algorithms to detect these and other failure 
modes will be considered here. 

The GLR test uses models of failure modes to detect failures. It 
is therefore, most capable of detecting the modes that are modeled. How- 
ever, each mode modeled requires a separate bank of filters which makes 
modeling even a small number of possible modes computationally costly. 
With only the bias failure mode modeled, the GLR algorithm was able to 
detect bias and ramp failures. The GLR algorithm had difficulty deciding 
if a stuck failure existed with only a 2 second data window; but had no 
difficulty in doing so with a 5 second data window. 

In the OSGLR algorithm, the failure modes are represented by a 
truncated series expansion rather than a fixed function. The series 
expansion chosen and the number of terms used determine how well a parti- 
cular failure mode can be represented. Using the first six terms in the 
expansion, the OSGLR test was able to detect bias, ramp, and stuck fail- 
ures (the only failure modes tested). These same six terms should be 
adequate to detect most other failure modes. 

One advantage of both the unmodified and the modified detection 
filter is that all failure modes should be detectable as the residual 
direction is independent of the failure mode, depending only on the sur- 
face which failed. 

2.4.2 Type of Failure 

All four algorithms were able to detect elevator, rudder, right 
and left aileron, and right and left flap failures. The left and right 
elevators were assumed to move together as a unit. Elevator and rudder 
failures could be isolated by all four algorithms. However, isolating 
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wing surface (aileron and flap) failures was difficult for all of the 
algorithms. Based on the few test cases simulated, the modified detec- 
tion filter could isolate a moderate wing surface failure (0.0349 rad 
(2°) aileron bias, 10% flap bias) to one of two possible surfaces in 
minor turbulence. The detection filter algorithm could eliminate one 
wing surface from consideration at most. It was demonstrated that false 
isolation could result with the GLR algorithm. Isolation to a specific 
wing surface is possible with the OS GLR algorithm with a significant de- 
lay of perhaps 10 seconds or more. 

2.4.3 Magnitude of Failure 

The magnitude of the failures that can be detected depends on the 

sensor noise, disturbances, and modeling errors. The GLR and OSGLR 

algorithms were able to detect moderate (0.01745 rad or 1° elevator, 

rudder and aileron) bias failures in the presence of noise and severe 

turbulence (a = 1.98 m/s or 6.5 ft/s). 

0) 

The detection filter and the modified detection filter were able 

to detect moderate (-0.0349 rad or -2° elevator, aileron, and 10% flap) 

failures in minor turbulence (a =0.3 m/s or 1 ft/s). However, 

a> 

detecting moderate failures in severe turbulence was more difficult. 

While hardover failures were not tested, they should be easily detected 
even in severe turbulence. 

Modeling errors also degraded the ability of all the algorithms to 
detect small failures. Detection of hard failures, though, should still 
be possible. 

2.4.4 False Alarm Performance 

False alarm rates can only be determined via simulation because 
analytic estimates are not available. (The analytic estimates of false 
alarm rates for the OSGLR algorithm cannot account for the effect of 
modeling errors.) However, determining even large false alarm rates 
using simulation is difficult because of the limited number of conditions 
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that can be tested and the large computational burden. Therefore, the 
false alarm performance of each of the algorithms will be qualitatively 
assessed by its sensitivity to noise, turbulence, and modeling errors. 
Algorithms that are sensitive to these effects can be expected to have 
larger false alarm rates than algorithms that are less sensitive. 

The OSGLR and GLR algorithms were least sensitive to noise and 
turbulence. This is true for two reasons: the system model incorporated 

into these algorithms included a turbulence model, and a Kalman filter is 
used to provide an estimate of the state. The unmodified detection fil- 
ter was sensitive to turbulence while the modified detection filter was 
very sensitive to turbulence. 

Since each algorithm incorporated a linear model of the aircraft, 
all four of the algorithms were very sensitive to modeling errors. The 
OSGLR algorithm appeared to be the most sensitive to modeling errors. 

2.4.5 Detection Time 

The failure detection times depend on the magnitude of the fail- 
ure, the sensor noise, the disturbances present, and the thresholds 
selected. Selecting thresholds for the GLR and OSGLR algorithms higher 
than the largest no-failure decision function levels at the nominal 
cruise flight condition (nonlinear simulation) would result in detection 
time for 0.01745 rad (1°) elevator and right aileron bias failures in 
severe turbuleance on the order of a second. Using the same thresholds 
for detecting rudder failures as for other control surface failures, 
would result in longer detection times. The rudder decision functions 
are smaller than those of the other control surface decision functions 
for the same magnitude failure. However, the effects of mismodeling 
affect the rudder decision functions less than the other decision func- 
tions. Therefore, smaller thresholds for the rudder decision function 
could be used, allowing the rudder detection times to be comparable to 
the other control surface detection times. 
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Detection times for both the modified and unmodified detection 
filters also depend on the filter eigenvalue chosen and the time constant 
of the low- pass filter, if any, required to suppress noise in the resi- 
dual. The detection times were estimated based on the time delay between 
failure onset and a clear indication that a failure has occurred. For 
the unmodified detection filter, approximately two seconds would be 
required to detect 0.0349 rad (2 deg) elevator or right aileron failure 
in minor turbulence with the residual being low-pass filtered with a time 
constant of one second. A 0.0349 rad (2 deg) rudder failure would take a 
second longer. Detection times for the modified detection filter would 
be on the same order as for the unmodified detection filter. 

While the detection times were comparable for all the algorithms, 
the GLR and OSGLR algorithms were tested in turbulence of intensity 1 .98 
m/s (6.5 ft/s) as opposed to 0.3 m/s (1 ft/s) turbulence intensity for 
the detection filter algorithms. 

2.4.6 Computational Burden 

The computational burden of all of the algorithms has not been 
quantitatively determined. Yet, some approximate comparisons will be 
made here. Each of the algorithms consists of a filter of the system to 
generate a residual, some type of residual processing, and a test for 
failures. The filter portion of each algorithm is computationally equiv- 
alent. Therefore, the relative computational burden can be determined by 
examining the computations required to process the residual and to test 
for the failure. 

The least additional computations are required by the unmodified 
detection filter. The residual processing would likely consist of sever- 
al banks of low-pass filters to give the algorithm the ability to quickly 
detect hard failures and still detect soft failures. To test for a fail- 
ure, the residual must be projected onto the failure signature plane seg- 
ments for each control surface. 
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The modified detection filter requires slightly more computational 
processing than the detectiton filter. The additional computations 
result from the secondary filtering of the residual which restores the 
P^op ei ^ty of a unidirectional residual in response to a control surface 
failure. 

The relative computational burden of the OSGLR algorithm is pri- 
marily determined by the number of actuators or control surfaces and by 
the number of terms in the series used to represent the possible failure 
modes. The residual is used to drive an additional filter for each con- 
trol surface to produce an information vector whose dimension is the 
number of terms used in the series expansion to represent the failure 
mode. The test for a failure in each actuator or control surface is the 
information vector weighted by an information matrix. For the time- 
invariant case considered in the preliminary evaluation, the information 
matrix is a constant matrix. For a large number of both actuators and 
terms used in the series, the computational burden would be very heavy. 
However, keeping only the first six terms of the series expansion was 
found to be adequate in the preliminary evaluation, with the six control 
surfaces considered in the preliminary evaluation, the computational 
burden of the OSGLR algorithm is at least 50% greater than the unmodified 
detection filter. 

The relative computational burden for the GLR algorithm is mainly 
a function of the number of actuators, the number of failure modes model- 
ed, and the data window chosen. Each actuator requires N correlation 
receivers for each failure mode modeled where N is the length of the data 
window divided by the time step. For a realistic data window of 2 
seconds, a 0.02 second time step, six actuators, and only modeling the 
bias failure mode, the GLR algorithm would be computationally very bur- 
densome. A comparison of CPU times for this window suggests that the 
GLR algorithm would require approximately 18 times more computation than 
the OSGLR test. 
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2.4.7 Robustness 


As each of the algorithms considered here relies upon a linear 
model of the system to detect and isolate failures, these algorithms will 
be sensitive to modeling errors. Modeling errors caused large GLR and 
OSGLR decision functions. However, The OSGLR test was shown to be more 
sensitive to modeling errors than the GLR test. An off-nominal cruise 
flight condition produced biases in the unmodified and modified detection 
filter residual projections. With these biases, detecting small wing 
failures at the nominal flight condition would be difficult, if not im- 
possible, unless dynamic thresholds or some other compensating approach 
is used. 


Another source of modeling errors for the GLR and OSGLR algorithms 
are the failure mode models incorporated into each of the algorithms. 

The OSGLR algorithm is likely to be robust to actuator failure mode 
modeling errors as the model is sufficiently general to represent most 
modes adequately. However, the GLR algorithm required specific models of 
failure modes such as bias failures. As only bias failures were modeled 
in the preliminary evaluation, the GLR algorithm is likely to be less ro- 
bust to other failure modes than the other three algorithms. 

2.4.8 Maturity 

The GLR algorithm is mature in both theory and in application. 

The OSGLR algorithm is almost as mature in theory as the GLR algorithm. 
However, as the OSGLR test is a recently developed FDI algorithm, there 
is very little experience in applying it. 

Detection filter theory is mature for restructurable controls appli- 
cation to linear, time— invariant systems with no input— to— output coup- 
ling (i.e. no acceleration measurements). However, no theory exists for 
applying the detection filter to time-varying systems* In addition, for 
systems with input- to- output coupling, systematic methods of using the 
extra degrees of freedom in the gain matrix calculation (which result 
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from having more measurements than states) and scaling to improve detec 
tion filter performance are needed. Finally, there is limited experience 
in applying the detection filter with only a couple of applications hav 
ing been reported. 

The modified detection filter, developed for this application, 
needs additional investigation to be considered mature in both theory and 
application. The problems of time-varying systems, improving performance 
through scaling, and the extra degrees of freedom in the gain matrix cal- 
culation mentioned above for the detection filter also apply to the modi- 
fied detection filter. 

2.4.9 Summary and Overall Comparison 

The eight issues addressed in this memorandum are summarized in 
Table 2.3. The GLR and OSGLR algorithms performed the best, especially 
in severe turbulence. However, the computational burden of the GLR algo- 
rithm is heavy and its ability to isolate wing surface failure modes is 
uncertain. The most significant advantage of the detection filter algo- 
rithms is their relatively low computational processing requirements. If 
the sensitivity of the detection filter algorithms to turbulence could be 
reduced, their performance might be comparable to the GLR and OSGLR algo- 
rithms. The most significant disadvantage of the OSGLR algorithm is its 
sensitivity to modeling errors. Still, the OSGLR algorithm is the most 
promising of these four algorithms evaluated. 

2.5 System Monitoring Strategy 

A second program task was to develop a system monitoring strategy 
for the detection and isolation of aircraft actuator and control surface 
failures. Before discussing the issues, the advantages and limitations 
of three applicable FDI techniques will be considered: local actuator 

FDI, analytic FDI algorithms such as those considered in this program, 
and the use of surface position measurements. 
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Table 2.3. Comparison of FDI Algorithms (Cont 







a) 








p 

<D 






lO 

G 

O 

G 




0 


i H 

G 

•h a) 




> 

ro 


<u 

o 




-P 

O 

<d 

i— i 

p G 


z 



• 

4-1 

0 

a) a> 

Q 

o 

pti 

>1 o 


43 

tT 1 rH 

W 

H 

w 

1 — I 


to 

P 

G 0 

M 

IP 

H 

<u 

P 

td 

G 

0 X> 

Pm 

U 

XI 

■p 

O 

•H 

4-> 

rH P 

H 

W 

H 

td 

4-1 

JQ 


G 

Q 

Eh 

Cm 

6 



P 

>i -P 

O 

W 


•rH 

tO 

«— «» 

0 

rH 

as 

Q 


X 

*0 

o 

c 

X <D 




0 

c 

CN 


rd P 




P 

0 

■ — ■ 

a 

43 0) 




CM 

o 



0 > 




cu 

aj 

td 

g 

p a) 




< 

to 

P 

-H 

CM to 




1 

•H 




-P 




to 




a) 




> 




c 







p 

a> 


o 

0 

p 


0 

o 

0 


o 

CM 

e 

g 



to 

o 




•H 



0) 

-p 



a) 

<d 



Z 

o* 





to 

• 



€ 

o g 



<u x: 

a> n3 



x: -p 

to n) 



*P »H 

p a) a> 



p 

4h P U 



g 0 

rH ID 2 c 



td tp 

Id ^ H 0) 



43 rH 

X3 r- *H rH 

a) 


-P td 

r (d 0 

-p 



(d O 4H x 

1 « 

03 

<u a) 

• p 

p 

O 

to a) 

com? 

a) 

o 

p p 

td td -P 

•c 

o 

o x: 

43 U -rH 

o 


> -p 

-P O 43 <D 

z 



4H P 



■* p 

to ^ <D 



P 0) 

ID d o > 



o x: 

a> c r- a> 



o -P 

P O ^ ID 



CM O 


to 




i 




03 








C 








0 

o 







o 

«— 


fl) 





a> 



o 


*c 



to 

03 

G 

G 


o 




td 

-rH 

<U 


o 



m 

p 


rH 




a> 

• 


d) 

G 

>* 


p 

p 

o 

m 

P 

43 

> 

o 

o 

G 



G 

p 

td 

-p 

o 

-P 

c 

r- 

i— l 

G 

a) 


CM 

td 

<d 

* — 

*H 

-P 

S3 

p 


z 

x: 

o 

(d 



o 



-p 

• 

4H 

d> 


o 




o 


P 


PM 



to 


to 

a 





to 

p 

td 

> 





0) 

0 

*»H 

<D 





X 

4H 


to 






- 36 - 


Much No previous experience Some No previous experience 





















2.5.1 Local Actuator FDI 


Direct duplication of actuation has been the practice for most 
military and large commercial aircraft for quite some time. Whole actua- 
tion channels may be duplicated several times. There have been several 
methods devised for dealing with failures of elements in these channels. 
The subsystems and channels must be substantially identical in order to 
give the same control inputs and to enhance the performance of the 
system. Some differences are inevitable because of tolerances, and these 
must be taken into account so that disengagement of a channel will occur 
only under genuine failure conditions. The performance of the subsystems 
and channels is continuously adjusted, in a process called equalization 
(Reference 16). As a part of equalization, inter-channel differences are 
minimized through feedback. If a difference is too great, then the fail- 
ed channel is disengaged or bypassed. Frangible elements (shear pins, 
for example) have also been used, allowing a jammed actuator to be broken 
by the others. Thus, a large degree of actuator FDI (and reconfigura- 
tion) already takes place on a local level. However, there are failures 
such as jams, actuator bias, inappropriate overall actuation gain, or 
control surface damage which the local FDI scheme will be unable to de- 
tect. 


2.5.2 Analytic FDI 

Analytic FDI schemes, such as those considered in this program, 
look for control surface failure signatures in the whole-system 
dynamics. That they detect failures at the system level (ultimately the 
most important one) is what makes these schemes potentially of great 
value. They can be considered most useful in the context of aircraft 
actuator FDI in identifying failures that the low-level FDI schemes have 
missed. Such failures might include inaccuracy or breakdown of the local 
schemes and actual physical damage to the control surface itself. How- 
ever, analytic FDI schemes have been shown to have difficulty in fully 
isolating failures among control surfaces that are functionally redun- 



dant. Thus, isolating a wing surface failure to a specific flap or aile- 
ron was difficult. The quantitative measures developed to determine the 
maximum discrimination of such failures showed the inherent difficulty. 

The value of actually isolating a failure of a surface that is 
functionally redundant might be questioned to some degree. After a sur- 
face fails, it is required that sufficient capability remain to end the 
flight in an acceptable way. If there is sufficient capability and if 
this can be appropriately determined then complete failure isolation 
might be considered optional* However, the ability to quickly and accu- 
rately determine the functional capability of the aircraft while in 
flight does not exist at the present time. Furthermore, there are rea- 
sons why isolation to a specific surface would be preferred. It is like- 
ly that a failure could be more quickly and appropriately compensated if 
it were fully isolated. Moreover, full isolation might allow for more 
flexibility and confidence in continuing a flight after a failure has oc- 
curred. Therefore, full isolation capability is taken as the simpler and 
more desirable option. 

2.5.3 Control Surface Position Sensors 

Position sensors mounted on or near the control surface itself 
could be considered to provide information on a level just below that of 
the whole system. Information from these transducers can be expected to 
be reasonably easy to obtain and use. Position transducers of the syn- 
chro, potentiometer, and linear variable differential ( LVDT) types have 
been extensively used and are simple (Reference 17). For these position 
transducers to be an independent source of information on any type of 
failure, however, they should not be part of the actual flight control 
loop. (position sensors are not presently used by aircraft control sys- 
tems • ) 

Flight control systems in which control loops are closed using 
aircraft dynamic information will automatically compensate for some actu- 
ator failures, such as small surface bias errors. To identify larger 
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biases, comparing actuator position expected (using a reference model) 
with that actually measured by position transducers might suffice to iso- 
late a failed surface. Alternately, in a separate actuator positioning 
flight control mode in benign flight conditions, commanding the surface 
to move to some absolute position or to move a certain fixed amount could 
suffice to detect and isolate biases or incorrect gains. If the surface 
is jammed, FDI using outputs from position transducers is also possible, 
using tests similar to those described for biases. 

Employing an FDI scheme based on surface position measurements 
involves additional hardware and perhaps the design of separate flight or 
test modes. In addition, FDI of the surface position sensors may also be 
required. It should be stressed, too, that position transducers would 
still be of only limited use in identifying certain types of failures, 
such as actual control surface damage. 

2.5.4 System Monitoring Strategy Selected 

An analytic whole-system FDI scheme is preferable as it can detect 
failures that may not be detectable by either the local FDI scheme or by 
position sensors. However, since analytic algorithms have some 
difficulty isolating failures, they could be augmented with direct sur- 
face position sensors to provide information for complete failure isola- 
tion, eliminating the uncertainties inherent in fully identifying the 
failure of a functionally redundant surface. Only a limited nunmber of 
transducers might then be required, and limited use made of their infor- 
mation. Use of position sensors to augment analytic FDI schemes also im- 
plies that each scheme could serve as a limited check on the other, pro- 
viding a more reliable FDI system. While information from the local act- 
uator FDI scheme may be of limited use also in this regard, this informa- 
tion will not be considered. 

The system monitoring strategy for the C-130 aircraft considered 
in this evaluation (assuming that the elevators move together) would be a 
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combination of the best analytic FDI algorithm (the OSGLR test) with 
position sensors on each of the wing surfaces* 

2*6 Conclusions 

The major conclusion which may be drawn from the results of this 
study is that algorithmic failure detection and isolation may be feasible 
for restructurable control applications. This conclusion must be quali- 
fied by the results obtained during this preliminary evaluation which 
have been basically limited to a single operating condition and to the 
investigation of a small subset of the potential failures. In particu- 

failure detection at the nominal flight condition does not appear to 
be a problem. Each of the algorithms was able to detect small elevator, 
rudder, aileron and flap failures for the C-130 aircraft in turbulence. 
The isolation of control surface failures was not a problem for elevator 
and rudder failures. However, difficulties arose in the isolation of 
i.e., aileron and flap, failures. These failures have a 
similar effect on the responses of the aircraft system. This difficulty 
highlights the potential need to augment the analytic FDI algorithms with 
the direct measurement of failures using, for example, position sensors 
on some of the control surfaces. 

The OSGLR algorithm performed best of those evaluated. The gener- 
al representation of the failure mode implies that most failure modes 
should be detectable. All failure types investigated during this study 
were detected and isolated, although there was a long time delay associ- 
ated with isolating the wing surface failures. Bias failures on the or- 
der of a degree of surface deflection were detected in approximately a 
second for a system without modeling errors. The computation and burden 
associated with this algorithm is moderate relative to the others, and 
the theory associated with it is mature. However, robustness properties 
of the OSGLR test are worse than those of the other algorithms. In addi- 
tion, the OSGLR algorithm has not been previously applied to any system. 
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The GLR algorithm also performed well in the 0130 application. 

The major drawbacks associated with it are its heavy computational bur- 
den, its lack of robustness to failure mode uncertainty, and its poor 
wing surface isolation performance. The most significant advantage of 
the detection filter algorithms is their relatively low computational 
processing requirements. If the sensitivity of these algorithms to tur- 
bulence could be reduced, their performance might be comparable to the 
GLR and OSGLR algorithms. None of the algorithm was robust to model un- 
certainty. 

In our judgement, the OSGLR algorithm is the most promising of the 
algorithms evaluated and, therefore, will be investigated further. The 
poor robustness to modeling errors of the OSGLR algorithm can, we 
believe, be improved; reducing the sensitivity to these errors of the 
OSGLR algorithm is the subject of Section 4. Many of the ideas presented 
there are applicable to other FDI algorithms as well. 
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SECTION 3 


A SURVEY OF FDI TECHNIQUES APPLICABLE TO AIRCRAFT 
CONTROL SURFACE FAILURE DETECTION AND ISOLATION 


3.1 Introduction 

In order to determine if there are practical FDI alternatives to 
the three algorithms already evaluated, a survey of FDI techniques that 
might be applicable to detecting and isolating aircraft control surface 
and actuator failures is presented. This survey is based largely on 
Reference 18. A discussion of several general categories of FDI algo- 
rithms will follow, with attention to those algorithms that might be 
usable in the aircraft application. The conclusions section summarizes 
the results of this search. 

3.2 Failure Sensitive Filters 

The detection filter can be considered one of the class of failure 
sensitive filters used for FDI. This class also includes limited memory 
filters and filters augmented with the parameters of hypothesized fail- 
ures included as state variables. Limited memory filters are effectively 
used only for failure detection, because they are not failure specific. 

By keeping the residual gain high, it is hoped that a failure can be 
expected to result in a sudden and pronounced change in the filter 
behavior. Filter state augmentation does help in this regard, but at the 
expense of potentially quite large dimensionality. The augmented filter 
will not be able to match the detection filter’s ability to respond to 
any failure manifested in a known direction, and the augmentation serves 
to decrease performance of the filter when there are no failures. 


- 42 - 



3.3 


Innovations -based Systems 


The GLR and OSGLR algorithms belongs to the group of FDI schemes 
known as innovations-based systems . These monitor the innovations of the 
(typically) Kalman filter designed for the unfailed system. This group 
also includes simple residual magnitude monitoring for failure detec- 
tion. The GLR algorithm attempts to detect and isolate additive failures 
using knowledge of the different effects such failures have on the 
(linear) system innovations. Because the exact form of the failure is 
generally unknown, some estimate is needed in order to have an accurate 
indication of failure. This failure estimation is inherent in any GLR 
scheme. Matched correlation detectors, in general each assuming a 
particular direction, mode, and time of failure, use as inputs the 
residuals of the normal mode filter and estimate the unknown associated 
with the failure. These estimates are then used in composite tests for 
the presence of particular failures. 

The OSGLR algorithm is similar to the GLR algorithm in many ways. 
However, the OSGLR algorithm represents the failure mode by a truncated 
series expansion. A matched filter for each control surface is used to 
estimate the coefficients of the truncated series expansion. The order 
of the matched filter is the number of terms in the truncated series ex- 
pansion. Also, no explicit estimation of the time of failure is required 
by the OSGLR approach. 

In aircraft application, in which the direction of the failure is 
known, effective use of the traditional GLR algorithm would probably in- 
volve hypothesizing one or more different failure modes, e.g., bias or 
ramp. Assuming only certain limited modes can give the GLR algorithm 
some robustness with respect to other, different modes of failures. The 
OSGLR algorithm, however, avoids the complexity of specifying different 
modes, since inherently it allows for any. 
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The traditional GLR algorithm explicitly estimates time of fail- 
ure onset, resulting in a time-linear growth in the number of detectors. 
Limiting the possible times of failure onsets to the recent past limits 
this growth. However, this "windowing" may degrade detection and isola- 
tion performance, especially if the window is chosen such that the GLR 
algorithm is computationally efficient. The windowing approximation need 
not be made in the OSGLR algorithm, however. Although the OS GLR 
algorithm cannot explicitly estimate time of failure, no new matched 
filters need be created. 

The FDI algorithms evaluated so far have been used with a linear- 
ized model of the C-130. FDI performance suffers when the operating con- 
dition is far from nominal. Caglayan and Lancraft have applied the GLR 
ideas to systems for which the no-failure filter is an EKF (Reference 
19). The nonlinear filter formulation gives a more complex but flight 
path-independent scheme, eliminating the need for gain scheduling. In 
the C-130 application, much of the model information is available only 
through tables. This makes the prospect of EKF filtering unlikely with- 
out extensive changes in the modeling representation. This may merit 
some consideration, however. 

3.4 Multiple Hypothesis Filtering 

Multiple hypothesis filtering schemes have also been proposed for 
FDI. In the exact application of this concept, a "bank" of full-order 
linear filters is constructed, with each filter based on a different 
hypothesis concerning system behavior. The innovations from the filters 
are then used to compute the probability that each system model is the 
correct one. This type of scheme has all of the drawbacks of the tradi- 
tional GLR algorithm, in that the number of filters grows with time. 
Windowing of data is also possible here. Unlike the GLR algorithm, state 
estimation for the failed system is immediately available with the 
multiple hypothesis filter schemes since there is a filter valid for each 
failure hypothesis. However, state estimation for the failed system with 
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the innovation-based systems is possible by approximately compensating 
for the effects of an additive failure on the no-failure filter. If a 
complete set of failure types and modes can be delineated, multiple 
hypothesis filtering schemes can be expected to give the best possible 
FDI performance. Their complexity, however, renders them impractical. 

3.5 Generalized Bayesian Tests 

Generalized Bayesian tests (Reference 20) , as another class of se- 
quential algorithms, seek to provide optimal failure detection and isola- 
tion through the assignment of costs for making certain decisions at cer- 
tain times. The optimal FDI strategy minimizes the expected overall 
cost. This class of algorithms can be considered the most general at the 
present time. Potential application is to any system for which a priori 
information concerning possible failures is available. (This is implied 
in the term Bayesian . ) Moreover, unlike most schemes, probabilistic in- 
formation about the overall FDI scheme is a byproduct of the optimiztion. 

The optimal FDI rule is generally not computable, but the struc- 
ture of the approach can be expected to be useful in deriving a practical 
suboptimal FDI algorithm. Reference 20 considers several possible 
approximations • 

3.6 Conclusions 

The detection filter can readily be considered the best of the 
failure-sensitive filters and the OSGLR algorithm the best of the innova- 
tions-based schemes for the linear time-invariant system with additive 
failures. They have been implemented, and it is doubtful that more comp- 
lex schemes would significantly enhance practical FDI performance. It is 
likely that simpler schemes would not be able to provide timely and accu- 
rate full failure identification. It should be noted that generalized 
Bayesian schemes are relatively new and undeveloped; a good characteriza- 
tion of their potential suitability will come only as a result of future 
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research. The attractive decision-cost optimality comes, however, with 
solution of a difficult problem. 

Based on this survey and the results of the initial evaluation 
(described in Section 2), the OSGLR algorithm, in our opinion, has the 
most potential of the algorithms that are mature for the Rest rue tur able 
Controls Application. Therefore, only the OSGLR algorithm will be inves- 
tigated further. 
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SECTION 4 


ACCOMMODATION OF MODELING ERRORS FOR THE OSGLR ALGORITHM 


Effective analytic fault detection and isolation schemes require 
accurate system models. All the FDI algorithms investigated in the 
preliminary evaluation, especially the OSGLR algorithm, were found to be 
sensitive to modeling errors. Certain modeling errors are introduced in 
linearizing aircraft nonlinear dynamics and in using a model during 
periods of off-nominal flight conditions. These errors will, at least to 
some extent, be attributed to control surface failures, and, consequent- 
ly# lead to larger decision functions than if there were no such errors. 
In fact, with significant mismodeling, the decision functions are 
unbounded in their growth. Therefore, it is not always possible to avoid 
false alarms associated with modeling errors by judicious selection of 
the detection thresholds. 

There are several ways of better accommodating modeling errors in 
analytic FDI algorithms. These might be considered as the following: 

• Dynamic thresholding - choosing decision thresholds based on 
estimates of the system state or, perhaps, the disturbances 
present (e.g., turbulence). 

• Dynamic decision regions - determining the statistics of the 
FDI residual, and choosing the threshold given those 
statistics. 

• Actual model error estimation, and use of those estimates in 
offsetting residual errors. 

• Robust design of the actual residual generator, leading to a 
sub-optimal scheme over the expected range of model errors. 
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While some of the above approaches have been used to reduce modeling 
errors in a number of FDI applications, no applications of FDI techniques 
in which the errors are propagated through a filter have been discover- 
ed* The F-8 study (References 21 and 22), for example, uses some fairly 
sophisticated modeling error accommodation, but the FDI is for sensors 
whose output can be more or less directly compared. 

This section will consider each of the four approaches in 
attempting to reduce the sensitivity of the OSGLR algorithm to 
midmodeling* 

4*1 Dynamic Thresholds 

Detection thresholds can be tied to estimates of the state or of 
system disturbances or expressed as increasing functions of time during a 
maneuver, perhaps, e.g., T = (a + bt) 2 * While it is difficult to see 
how dynamic thresholds can be systematically designed for filter 
residual-based FDI schemes (like the detection filter and OSGLR), one 
approach was investigated* 

One measure of the sensitivity of the OSGLR algorithm to 
mismodeling is 


T -1 

. X s X .. _ 

min T __ 1 (4.1) 

X s X 

where is the information vector, S is the nominal information matrix 

used to calculate the decision function, and S is the actual information 

matrix. A graphical interpretation of this measure is shown in Figure 

4*1* This minimization both determines the direction (in ^ space) in 

which the nominal implementation is sensitive to a particular mismodeling 

T -1 

and the largest a ellipse of the actual decision function S that is 
contained in the 1 a ellipse of the nominal decision function S j^* 
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If determining the actual information matrix S is possible, one 

approach for compensating for the mismodeling effects might be to 

increase the threshold, T^, of the nominal decision function such that 

the T a ellipse would contain or mostly contain a T|a ellipse for 
T -1 2 

X s X* T -| threshold that yielded adequate performance with no 

mismodeling. 

For mismodeling that results in changes in the linear model, the 
actual information vector S can be determined by combining the Kalman 
filter and OSGLR equations as implemented with the actual linear model 
(including the effects of mismodeling) into a single linear system. 
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where jc(k) and x~(k) are the linear system state and the Kalman filter 
state estimate respectively. j^(k) ^* s the information vector time 
shifted one time step: 


X, 00 = x (k_1 > 
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The superscript (*) indicates that the matrix is either a nominal linear 
model matrix or steady-state Kalman filter and OSGLR matrices based on 
the nominal linear model. The actual linear model matrices are not 
superscripted and 


AD = D-D* (4.4) 

The process and measurement noise are represented by w(k) and v(k). 

Since the information matrix is simply the covariance of the actual 
information matrix S is the lower right-hand block of the augmented state 
covariance matrix: 


(4.5) 


One difficulty with this approach is that the actual information 
matrix is a function of the covariance of the inputs unless modeling 
errors do not affect the B and D matrices. Instead of trying to appro- 
priately describe the covariance of the inputs, the control system could 
be included in the augmented linear system (Eq. 4.2). However, the 
actual information matrix then becomes a function of the covariance of 
the commands to the control system. One approximation might be to assume 
the covariance of the commands to be zero. A much better approximation 
would be to assume the pilot is a feedback system. 

Assuming the covariance of the inputs is somehow described, the 
actual information vector can be determined by propagating forward in 
time the augmented state covariance matrix or by solving a Lyapunov 


E(x(k)x T (k)] E[x(k)x T (k) ] 


E[x(k)x T (k) ] 
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equation for the steady-state covariance matrix. In the latter case, the 
actual linear model must be stable unless the control system is 
included. Then the sensitivity of the OSGLR algorithm to this change in 
the linear model could be determined and the threshold compensated. This 
analysis alone is not adequate in selecting thresholds as nonlinearities 
not represented in the linear models are not taken into account. Also, 
mismodeling may cause the information vector to become biased, or worse, 
to grow without bound. 

This sensitivity analysis was not performed in this effort as 
describing the control system of the C-130 aircraft was prohibitive. 
Without a systematic method to design dynamic thresholds, a trial-and- 
error procedure would have to be used, 

4,2 Dynamic Decision Regions 

Filter sensitivity results can also be used to implement dynamic 
decision regions for the detection test used in the OSGLR algorithm. The 
form of the detection test is the information vector weighted by the 
information matrix and compared to a threshold. 


/s \ l T x (4.6) 

The information matrix reflects the expected uncertainty associated with 
the basis function coefficient estimates. The certainty predicted in the 
filter generally does not take into account modeling errors, however. In 
order to reduce false alarms, one might like S to reflect the uncertain- 
ties associated with modeling errors even in the absence of failures. 

The basic idea then is to use the actual information matrix as 

opposed to the nominal information matrix in calculating the decision 
T -1 

function S The actual information matrix could be calculated as 

outlined in the previous section. Instead of continuously updating the 
information matrix, it would be more efficient to bound S in an 
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approximate manner, Even better would be to approximate S as a function 
of operating parameters, states, or inputs. As discussed in the previous 
section, certain nonlinearities and biases or unbounded growth in the 
information vector caused by mismodeling cannot be dealt with using this 
approach • 

4.3 Model Error Estimation 

A third option in accommodating modeling errors in FDI involves 
estimating these errors directly. This could be, of course, a highly 
effective option, but it would probably be difficult to account for much 
of the error and would thus be computationally prohibitive. Moreover, 
this extensive estimation could probably be foregone without bad 
consequences if one of the other accommodation options were employed. 

4.4 Robust Residual Generation 

The OSGLR algorithm nominally depends on residuals produced by a 
Kalman filter to detect and isolate failures. Either improving the 
robustness of the Kalman filter or using a more robust filter than the 
Kalman filter will reduce the effects of modeling errors on the OSGLR 
algorithm. The need for reducing the sensitivity of the Kalman filter to 
modeling errors is apparent even at the nominal cruise flight condition. 

Figure 4.2 shows the predicted state covariance and the actual 
aircraft state estimation errors for a segment of nominal, no-failure 
flight, using a single linear model in the Kalman filter. Even here, a 
case for which the modeling errors are expected to be small, the estima- 
tion errors are not well bounded by the covariance. Figure 4.3 shows the 
corresponding OSGLR decision functions, which are large. 1 Practical 
improvements might involve adding process noise to the Kalman filter (in 


1 


Appendix A contains a summary of test cases presented in this report 
for easy reference and comparison. 
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Decisions Functions (xlO) 




addition to the turbulence process noise already present), or perhaps 
using so-called limited memory filtering in the OSGLR. Either technique 
curtails growth of the actual estimation error covariance and increases 
predicted covariance. Use of either technique could also be expected to 
desensitize the decision functions to errors due to both linearization of 
the nonlinear dynamics and off-nominal maneuvering of the aircraft. 

There is no method of systematically selecting process noise to 
reduce the effects of mismodeling on the Kalman filter. The designer 
must resort to a trial-and-error procedure of selecting the process noise 
and testing the resulting Kalman filter. The other difficulty with this 
approach is that the choice of process noise may reduce the effect of a 
failure on the Kalman filter residuals, degrading the ability of the 
OSGLR algorithm to detect and isolate that failure. In spite of these 
difficulties, this approach was briefly investigated. A set of state 
covariance weightings were determined such that 0.01745 rad (1°) elevator 
and right aileron bias failures, 0.0349 rad (2°) rudder bias failures, 
and 5% right flap bias failures still could be detected and isolated at 
the nominal cruise condition 77.2 m/s (150 knots) at 304.8 m (1000 ft) 
while greatly reducing the no-failure decision function at the off- 
nominal cruise condition 102.9 m/s (200 knots) at 1524.0 m (5000 ft). 

(The process noise added was in addition to the turbulence process noise 
already driving the system.) The decision functions for the 0.01745 rad 
(1°) elevator bias failure and the off-nominal no-failure test cases 
using the nominal (no process noise) Kalman filter and OSGLR algorithm 
are shown in Figures 4.4 and 4.5, respectively. The decision functions 
for the same two test cases using the Kalman filter and OSGLR algorithm 
designed using process noise are shown in Figures 4.6 and 4.7. Schedul- 
ing the threshold in terms of distance from the nominal point might allow 
for quick detection of failures close to the nominal cruise condition 
while reducing the effects of mismodeling. 

Limited memory filtering is to be preferred as it can be implemen- 
ted in such a way that it is general, simple, and quite effective. The 
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Figure 4.4 OSGLR decision functions for a -0.01745 rad 
(~1°) elevator bias failure which occurred 
at 10 seconds at the nominal cruise flight 
condition of 77.2 m/s (150 knots) and 
304.8 m (1000 ft) 
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Figure 4.5 OSGLR decision functions for a no-failure case 
at an off-nominal cruise flight condition of 
102.9 m/s (200 knots) and 1524 m (5000 ft) 
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basic idea of limited memory filtering is the more or less gradual elimi- 
nation of old data, as it is no longer thought to be meaningful. One ap- 
proximate method that can be used in the current application is the age- 
weighted filter (Reference 23). In this filter, discarding old measure- 
ment data is accomplished by weighting them according to when they oc- 
curred. In other words, the covariance of the measurement noise is in- 
creased for past measurements. For assumed constant measurement noise 
covariance R, one manner of accomplishing this is to set 

R£_ m = (e mAt/T )R, m = 0,1,2... (4.7) 


where R' is the new noise covariance and k denotes the current time in 
the filtering. At is the measurement (sampling) interval, and x is a 
time constant associated with the length of time the model is considered 
valid. 

A recursive filter can be constructed under these assumptions. 

The only difference between the resulting algorithm and the standard 
Kalman filter is the appearance of the age-weighting factor s = T in 

the state covariance update equation: 

p k<- 1 - + V, (4 - 8 > 

Otherwise the age-weighted filter equations are the same as the Kal- 
man filter equations (Eqs. 2.25-2.30 and Eq. 2.32). Compared with the 
original Kalman filter, the factor s, being greater than 1, leads to 
larger state and measurement covariances and, consequently, a larger 
filter update gain. The result is a faster tracking filter. Only the 
steady-state implementation of the age-weighted filter is tested in 
this report. 

If the measurement noise covariance matrix is actually constant 
and the age-weighting is being used to produce a faster tracking filter 
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as in this report, the is not the state error covariance matrix 

A 

)<x k 

using results for a filter of the form of the Kalman filter but with an 
arbitrary gain matrix* The measurement error covariance matrix is calcu- 
lated by using the correct state error covariance matrix* For convenien- 
ce, since the actual covariance matrices are not of interest, the covari- 
ance matrices including the effects of age-weighting will be referenced 
to the age-weighted filter state error and residual covariance matrices. 


-x^) 7 ]. The state error covariance matrix can be calculated 



The (normal) OSGLR FDI scheme involves the use of a no-failure 
Kalman filter and what are essentially matched Kalman filters for the 
various control surface failure hypotheses driven by the residuals of the 
no-failure filter* (Recall that for each control surface there is basi- 
cally an estimator for the coefficients of the failure signature func- 
tion.) Implementing an age-weighting filter for only the first, no- 
failure filter has been found to result in little change in the size of 
the decision functions* Age-weighting should thus be implemented in the 
matched filters as well. These filters are implemented in "information 
form", a form equivalent to the more common form of the Kalman filter* 


The change in the standard filter equations can be mapped into the 
information form equations. This results in changes in the propagation 
equations for the information vector and information matrix. In the 
matched filters, 


X' (k+1 ) 
s' (k+1 ) 


+ G T (k+1 )M _1 (k+1 )^(k+1 ) 

— A.s'OOA* + G T (k+1 )M _1 (k+1 )G(k+1 ) 
s 9 (J) 


(4.9) 

(4.10) 
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Here 


A is the single-step transition matrix for the coefficients, 

<P 

a, being estimated; 

G is the residual influence matrix for the system; 

y is the residual of the no-failure filter; and 

M is the residual covariance of the incoming measurements y 

including the effect of age-weighting. 

As with the age-weighted filter, only the steady-state implementation of 
matched filters with age-weighting will be tested in this report. 

The effect of age-weighting on the OSGLR algorithm can be seen 
from Figures 4.8 and 4.9, The decision functions for the off-nominal, 
no-failure test case and the -0.01745 rad (-1° deg) elevator bias failure 
(occurring at 10 s) test case with age-weighting time constant of 15 s 
are shown in Figures 4.8 and 4.9, respectively. The largest value of the 
decision functions for the off-nominal test case is reduced by age- 
weighting from 1,100,000 (at 50 s and increasing) to 45,000 for this 
age-weighting time constant of 15 s. The major benefit of age-weighting 
is to limit the decision functions caused by modeling errors. Otherwise, 
false alarms would be certain to occur. However, age-weighting also re- 
duces and limits the decision functions caused by failures. The largest 
value of the decision functions for the -0.01745 rad (-1 deg) elevator 
bias failure test case was reduced by age-weighting from 400,000 (at 50 s 
and increasing) to 40,000 (and increasing at 50 s although more slowly) 
for the time constant of 15 s. 

The effect of age weighting ultimately depends on the age-weight- 
ing time constant chosen. As the time constant is decreased, past infor- 
mation will be discarded sooner and the size of the decision functions 
caused by both modeling errors and failures will decrease. However, in 
order to allow the state estimates to converge, the age-weighting time 
constant should be larger than the time constant associated with the 
smallest closed-loop filter eigenvalue. With no age-weighting, the 
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Figure 4.8 Decision functions produced by an age-weighted 
OSGLR algorithm 

• no failures 

• off-nominal cruise flight condition of 
102.9 m/s and 1524.0 m 

• age-weighting time constant of 15 s 
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Figure 4.9 Decision functions produced by an age-weighted 
OSGLR algorithm 

• -0.01745 rad (-1°) elevator bias failure 
at 10 s 

• nominal flight condition of 77.2 m/s 
and 304.8 m 

• age-weighting time constant of 15 s 


largest filter time constant is 1.4 s. Small age-weighting time 
constants may also cause difficulty in the convergence of the higher 
order basis function coefficient estimates. Figure 4.10 shows the 
estimated rudder basis function coefficients for a 0.001745 rad/s 
(0.1 o /s) rudder ramp failure starting at the beginning of the test case. 
The age-weighting time constant is 3 s. The first four coefficients 
converge reasonably well, whereas the last two, although they remain 
fairly well behaved, have more difficulty. Still, the convergence of the 
basis function coefficients was adequate for this case. 

The 3 s age-weighting time constant was investigated in addition 
to the 15 s time constant already considered. The decision functions for 
the off-nominal, no-failure test case and the -0.01745 rad (-1.0 deg) 
elevator bias failure test case with age-weighting time constant of 3 s 
are shown in Figures 4.11 and 4.12. The 3 s time constant reduces the 
largest value of the decision functions for the off-nominal test case 
from 45,000 for the 15 s time constant to 1600. Likewise, the maximum 
magnitude of the decision functions for the -1 deg elevator bias failure 
test case was reduced from 45,000 (and increasing) to 3500. Based on 
these two test cases, the 3 s time constant produces the greatest 
reduction in the decision function caused by mismodeling while causing 
the least reduction in the decision functions resulting from a failure. 
But an age-weighted time constant this small will make detecting failures 
of limited time duration difficult as the OSGLR algorithm will forget 
that a failure had occurred. These failures may not be significant 
though. Therefore, in the interest of keeping the decision functions as 
insensitive to modeling errors as possible, the 3 s age-weighting time 
constant will be used from henceforth. 

4.5 Summary and Conclusions 

Several options for accommodating modeling errors in failure de- 
tection and isolation have been discussed. These included dynamic 
thresholds, dynamic decision regions, model error estimation, and robust 
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Figure 4.12 Decision functions produced by an age-weighted 
OSGLR algorithm 

• -0.01745 rad (-1°) elevator bias failure 
at 10 s 

• nominal cruise flight condition of 77.2 m/s 
and 304.8 m 

• age-weighting time constant of 3 s 


- 70 - 


residual generation. Using dynamic thresholds is a simple approach to 
reducing false alarms caused by modeling errors. However, since modeling 
errors will, in general, cause the decision functions to grow in an un- 
limited manner, this approach would not give satisfactory performance 
alone. Also, there is no convenient systematic approach for selecting 
the dynamic thresholds. The dynamic decision region approach alters the 
information matrix used to weight the information vector in calculating 
the decision function to better reflect the uncertainties associated 
with modeling errors. Similar to the dynamic threshold approach, this 
approach alone could not reduce the effects of mismodeling satisfactori- 
ly. In addition, the procedure suggested to design these dynamic deci- 
sion regions may as in the case of the C-130 aircraft, require signifi- 
cant effort. Model error estimation probably would be the most difficult 
and computationally burdensome of the four approaches. Two ideas were 
presented to improve the robustness of the filter used to generate resid- 
uals for the OSGLR algorithm. The first was to add process noise in 
certain directions (e.g., specific states). While adding process noise 
worked well for the few cases tested, the selection of the noise is an 
iterative process and may only be valid for that particular linear system 
model. The second idea, age-weighted filter, was found to be simple, 
general, and very effective. Age-weighted filtering allows the consider- 
ation of only the more recent information for estimating aircraft state 
and the basis function coefficients. Consequently, modeling errors due 
to linearization or aircraft maneuvering do not cause the filters to di- 
verge. 

Age-weighted filtering, because of its simplicity and effective- 
ness, will be used to reduce the effects of modeling errors. The age- 
weighting time constant will be 3 s. 
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SECTION 5 


DETAILED EVALUATION OF THE OSGLR ALGORITHM 
USING A SINGLE CRUISE LINEAR MODEL 


5. 1 Introduction 

In the preliminary evaluation described in Section 2, the 
steady-state implementation of the OSGLR algorithm was tested at a nomi- 
nal and an off-nominal cruise flight condition. Furthermore , only a few 
failure cases at the nominal cruise flight condition were tested. This 
section further examines the flight regime in the neighborhood of the 
nominal cruise flight condition 77.2 m/s (150 knots) at 304.8 m (1000 
ft). The effects of sensor errors , off-nominal flight conditions includ- 
ing maneuvers, different turbulence intensity levels, steady winds, and 
nonzero flap deflections are considered. 1 Also, a number of bias fail- 
ures are tested. Based on these results, the magnitude of bias failures 
that can be detected and the detection times (for this nominal flight 
condition) can be determined for a particular threshold. 

In this and the following section, DFj_ is the decision function 
whose failure hypothesis is that the ith control surface has failed. The 
control surfaces are defined in Table 5.1 


1 


A summary of the test cases is presented in Appendix A for easy re- 
ference and comparison of the test cases presented in this section and 
in sections 4 and 6. 



Table 5-1 • C-130 control surface definition 


Input 

Control Surface 

1 

elevator 

2 

right aileron 

3 

left aileron 

4 

rudder 

5 

right flap 

6 

left flap 


5.2 Sensor Errors and Dynamics 

Misalignment, scale factor error, and quantization were added to 
the acceleration and angular rate measurements. Biases were added to the 
acceleration, angular rate, and attitude measurements. Sensor models 
including first-order lag filter dynamics were included for all the 
measurements except for the altitude rate. 

The altitude rate measurement was eliminated because a sensor 
model was not readily available. The performance of the OSGLR algorithm 
was not affected in detecting and isolating elevator, right aileron, and 
right flap failures. However, eliminating the altitude rate measurement 
reduced the ability of the algorithm to isolate a 0.01745 rad (1 deg) 
rudder bias failure. Larger rudder failures, such as a 0.0349 rad (2 
deg) bias failure, still could be easily isolated. Therefore, the 
elimination of the altitude measurement caused only a minor degradation 
in performance. 

The OSGLR algorithm was tested with the sensor noise, errors, and 
dynamics shown in Table 5.2; the effect on the performance was too small 
to be evident. All the results presented in this report were produced 
with these effects of sensor noise, errors, and dynamics included. 
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5.3 


Off-Nominal , No-Failure Flight Conditions 


The steady-state implementation of the OSGLR algorithm based on 
the 77.2 m/s (150 knot) linear model was tested for a variety of 
maneuvering and other off-nominal flight conditions to determine their 
effects on the performance of the algorithm. This testing served to 
determine the range of flight conditions for which the 77.2 m/s (150 
knot) linear model is valid for the purposes of FDI. Light and 
thunderstorm turbulence and steady wind conditions were also tested. 

5.3.1 Maneuvering Test Case 

The first test case considered was a combination of cruise flight 
conditions and turning, acceleration, and climb maneuvers as described in 
Table 5.3. This test case will be referred to as the maneuvering test 
case. The aircraft begins cruising at 77.2 m/s (150 knots), then turns 
at 0.0524 rad/s (3 deg/s), returns to level flight, accelerates with full 
thrust, climbs at first with nominal thrust level and later full thrust, 
and finally turns slowly while climbing at full thrust. The decision 
functions for this test case are shown in Figure 5.1. The decision func- 
tions increase slightly as the aircraft rolls to begin the turn and again 
as the aircraft rolls to level flight. As full thrust is applied and the 
aircraft accelerates at an approximately constant altitude, the decision 
functions increase significantly# The decision functions decrease and 
become small again with the thrust level returning to the nominal value 
and the velocity decreasing with the aircraft climbing. In order to 
maintain the climb, the thrust level is increased and the decision func- 
tions increase significantly once again. 

As thrust level, or alternatively thrust, is an actual input to 
the system, incorporating thrust level or thrust into the linear model as 
an input might reduce the decision functions at off-nominal thrust 
levels. Thrust was found to be more effective than thrust level* Thrust 
is actually a nonlinear function of both thrust level and velocity. With 
thrust level as the input, some of the velocity dependence of thrust 
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Table 5.3 Maneuvering test case 


Time ( s ) 


Maneuver 


0-20 

20-25 

20-55 

50-55 

55-60 

60-100 

100-125 

105-165 

125-165 

145-165 


Nominal cruise condition 77*2 m/s (150 knots) at 

304.8 m (1000 ft), no flaps, 55% thrust level 

Roll to 0.4363 rad (25 degrees) 

Turn at approximately 0.0524 rad/s (3 deg/s) 

Roll back to level flight 
Nominal cruise condition 

Thrust level increased to 1 00% causing the ve- 
locity to increase from 77.2 m/s (150 knots) to 

102.9 m/s (200 knots) 

Thrust level decreased to nominal value 
Climb at an average rate of 6.7 m/s (22 ft/s) 
Thrust level increased to 100% 

Roll and turn slightly in addition to the climb 
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Figure 5 . 1 Decision functions for the maneuvering 
test case 


could be accounted for in the linear model. Still , less mismodeling will 
result with thrust as the input. (Thrust was added to the linear model 
simply by adding another column to the B and D matrices.) 

The decision functions for the maneuvering test case with thrust 
incorporated as an input are shown in Figure 5.2. The decision functions 
during the periods of off-nominal thrust levels are significantly de- 
creased. The largest decision functions are now during the acceleration 
at constant altitude portion of the test case rather than the climb with 
100% thrust portion. The decision functions during the acceleration at 
constant altitude portion increase as the velocity and therefore dynamic 
pressure increases. As the thrust level begins to decrease to the nomi- 
nal value at 100 s, the decision functions also decrease. The increased 
thrust level during the climb portion of the trajectory does not cause 
any difficulty. The probable reason for this is that the dynamic pres- 
sure is close to the nominal dynamic pressure. Based on this test, the 
largest no-failure decision functions occur when both the dynamic pres- 
sure and the thrust are significantly off-nominal. 

All further results use thrust as an input. 

5.3.2 Turning Test Case 

A longer turning maneuver, where the aircraft rolls and begins a 
0.0524 rad/s (3 deg/s) right turn at 5 s, was also considered. At 65 s, 
the aircraft returns to level flight having turned 190 deg. The aircraft 
then turns left starting at 75 s, returning to level flight at 130 s. 

The decision functions, shown in Figure 5.3, are small with the two 
largest spikes occuring when the aircraft first rolls to turn right and 
when the aircraft returns to level flight after the left turn. These 
spikes appear to correspond to off-nominal aileron activity required to 
roll the aircraft. 


- 78 - 



Decision Functions (xiO) 

80.00 160.00 240.00 320.00 400.00 



Time (s) 


Figure 5.2 Decision functions for the maneuvering 
test case with thrust as an input 



5.3.3 Maximum Rate-of -Climb Test Case 


In the maneuvering test case, the climbing rate of the aircraft is 
significant but less than the maximum possible. In order to determine 
the largest decision functions that could be produced by a sustained 
climbing maneuver, the algorithm was tested with the aircraft climbing at 
an average rate of 10 m/s (33 ft/s) which is approximately the maximum 
rate of climb. At the beginning of the test case, the aircraft is flying 
at the nominal cruise condition. Five seconds into the flight, the 
thrust level is increased to 100% with the climb initiated at 15s. The 
decision functions (Figure 5.4) are larger than in the climbing portion 
maneuvering test case but only 800 larger than the largest decision 
function produced by the maneuvering test case. 

5.3.4 Accelerating Test Cases 

A number of accelerating cases were tested with the most severe 
case being the acceleration from 51.44 m/s (100 knots) to 102.9 m/s (200 
knots) test case. The decision functions for this test case are shown in 
Figure 5.5. The largest decision functions are at the beginning of the 
test case. Initially, the airspeed of the aircraft is 51.44 m/s (100 
knots) but the airspeed drops a few seconds later to 33.44 m/s (65 
knots). This airspeed drop is caused partly by a large turbulence level 
at the beginning of the simulation run and also because the control 
surfaces are being moved to control the aircraft. The result of this 
airspeed drop is that the actual dynamic pressure a few seconds after the 
beginning of the test case is only 20% of the nominal dynamic pressure of 
the 77.2 m/s (150 knot) linear model. The linear model is clearly not 
valid in the neighborhood of 51.44 m/s (100 knots). The thrust level was 
increased to 100% starting at 10 s, causing the airspeed to increase. As 
the actual dynamic pressure approaches the nominal dynamic pressure, 
decision functions decrease. At 41 s, the airspeed is approximately 77.2 
m/s (150 knots) which is the nominal airspeed of the linear model and the 
decision functions are very small in this region. They increase again as 


! 


- 81 - 



20.00 


40.00 


60.00 


80.00 


100.00 


DO 


Time ( s ) 


Figure 5.5 Decision functions for the acceleration from 
51.44 m/s (100 knots) to 102.9 m/s (200 knots) 
test case 






the velocity increases to 102.9 m/s (200 knots). Based on this test 
case, there appears to be more mismodeling at low dynamic pressures than 
at high dynamic pressures. 

5.3.5 Decelerating and Descending Test Cases 

To investigate decelerating flight, the aircraft was started at an 
airspeed of 102.9 m/s (200 knots) with a thrust level of 30%. (The 
thrust level required to maintain 102.9 m/s airspeed at 304.8 m (1000 ft) 
is 80%. ) The altitude of 304.8 m (1000 ft) was approximately maintain- 
ed. The airspeed at the end of the simulation run is approximately 51 
m/s (100 knots). The decision functions, shown in Figure 5.6, are small 
until the airspeed drops below 61 m/s (118.5 knots). As in the maneuver- 
ing test case, the 150 knot linear model is not adequate for airspeeds in 
the neighborhood of 51 m/s (100 knots). 

Decision functions for a descending test case are shown in Figure 
5.7. The aircraft has an initial airspeed of 103 m/s at an altitude of 
1524 m (5000 ft) with a thrust level of 20%. The aircraft descends to an 
altitude of 762 m (2500 ft) at the end of the test case. The final air- 
speed is approximately 77 m/s (150 knots). The decision functions are 
small with the larger magnitudes occurring in the first 35 s where the 
dynamic pressure is the most off-nominal. 

5.3.6 Non-Zero Flap Deflections 

In addition to maneuvers, the OSGLR algorithm was tested with the 
flaps extended 50, 75, and 100%. In each of the test cases, the flaps 
were extended starting at 5 s, and reached 50% to 100% in 5 to 15 s. The 
decision functions for the 50% test case shown in Figure 5.8 are small. 
However, the decision functions for the 75% test case, shown in Figure 
5.9 are large. The decision functions for the 100% test case are approx- 
imately four times larger than those of the 75% case. One explanation 
for the large decision functions is that large deflections of the flaps 
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Figure 5.7 Decision functions for the descending 
from 1524 m (5000 ft) test case 
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causes significant changes in the dynamics. Also, large flap deflections 
cause a significant decrease in the airspeed and therefore dynamic 
pressure. 

5.3.7 Off-Nominal Turbulence and Steady Winds 

The nominal turbulence used to test the OSGLR algorithm is the 
Dryden model with clear air scales and intensity of 1.98 m/s (6.5 ft/s) 
(Reference 12). As the turbulence model is incorporated into the linear 
model of the system, the nominal turbulence does not cause significant 
no-failure decision functions. To determine the effect of off-nominal 
turbulence, light turbulence of intensity 0.3 m/s (1 ft/s) and thunder- 
storm turbulence of intensity 6.4 m/s (21 ft/s) were tested. The deci- 
sion functions for the maneuvering test case with light turbulence, shown 
in Figure 5.10, are slightly smaller than with the nominal turbulence 
intensity. The decision functions for the aircraft cruising at the 
nominal flight condition in thunderstorm turbulence are shown in Figure 
5.11. The validity of this test case is questionable for the first 20 s 
as the turbulence causes the angle of attack to exceed the largest angle 
of attack for which the aerodynamic forces are modeled. (The simulation 
needs a pilot to control the aircraft adequately in thunderstorm turbu- 
lence.) In general, the decision functions due to thunderstorm turbu- 
lence are significant. One approach to reduce the effect of thunderstorm 
turbulence might be to develop the age-weighted filter gain and the OSGLR 
influence and information matrices for the thunderstorm case and schedule 
these matrices as a function of turbulence level. A simpler approach 
would be to use a higher nominal turbulence level. This approach should 
be adequate if detection and isolation at lower turbulence levels is not 
significantly degraded. 

The effect of steady winds on the performance of the algorithm was 
determined by testing a number of wind conditions. The steady winds 
tested were headwinds, crosswinds, and a direction in between. These 
horizontal winds were all 10.3 m/s (20 knots). A downwind of 2.57 m/s 
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(5 knots) was also tested. The crosswind test case produced the largest 
decision functions (Figure 5.12). The large decision functions in the 
first ten seconds of the test case are caused by the aircraft responding 
to the crosswind. In response to the crosswind, the thrust was increased 
momentarily and the ailerons and rudder were used to control the air- 
craft. After the initial transient, steady winds do not result in 
increased decision functions. 

5.4 Failures 

Elevator, right aileron, rudder, and right flap bias failures are 
considered in this section. With two exceptions, all the failures occur 
with the aircraft flying at the nominal cruise flight condition of 77.2 
m/s (150 knots) at 304.8 m (1000 ft). The exceptions are elevator bias 
failures with the aircraft flying at two off-nominal airspeeds, 64.3 m/s 
(125 knots) and 90.0 m/s (175 knots). All the failures occurred 10 s 
into the simulation run. 

A representative failure test case for each of the surfaces tested 
as well as the two off-nominal flight condition test cases will be 

presented. In lieu of the individual failure cases, results for the 

nominal flight condition failure test cases are then summarized, for each 

surface tested, in terms of the maximum decision function as a function 
of the time from the occurrence of the failure and the failure magni- 
tude. The ability to isolate a failure of each of the surfaces tested is 
similarly examined. 

5.4.1 Elevator Failure Test Case 

The decision functions for the -0.0873 rad (-5 deg) elevator bias 
failure with the aircraft at the nominal cruise flight condition are 
shown in Figure 5.13. The growth of the decision functions is limited by 
the age-weighting, as in the off-nominal, no-failure cases. The failure 
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is easily detected if the detection threshold is less than 60,000. The 
failure can be detected in approximately 2 s if the threshold is less 
than 20/000. Four of the isolation decision functions, DF^j, are shown 
in Figure 5.14 where DF^j is defined to be 

DF, . = DF. - DF. 

ID l J 

Isolation decision function DF- 14 , not shown in Figure 5.14, would have 
been even larger than those shown. Isolating this failure is 
straightforward. 

5.4.2 Off-Nominal Elevator Failure Test Cases 

The decision functions for the same failure with the aircraft 
flying at an airspeed of 64.3 m/s (125 knots) at the time of the failure 
are shown in Figure 5.15. The decision functions rise more slowly than 
for the same magnitude failure occurring with the aircraft flying at the 
nominal cruise flight condition. The effect of the failure is less 
because the dynamic pressure for this case is less than the nominal 
flight condition. Still, a detection threshold that could detect a 
failure of the same magnitude at the nominal airspeed could detect this 
failure. At approximately 35 s, the decision functions peak and decrease 
afterwards. This decrease is caused by a decrease in the airspeed. In 
Section 5.3, the OSGLR algorithm based on the 77.2 m/s (150 knot) linear 
model produced large no-failure decision functions at low speeds in the 
neighborhood of 100 knots. Apparently, the 77.2 m/s (150 knot) linear 
model does not model the aircraft well at these low speeds. Also, as 
just mentioned, a decrease in dynamic pressure will reduce the effect of 
the failure. 

The decision functions for the -0.0873 rad (-5 deg) elevator bias 
failure with the aircraft flying with an airspeed of 90.0 m/s (175 knots) 
are shown in Figure 5.16. The decision functions rise more quickly than 
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the nominal flight condition -0.0873 rad (-5 deg) elevator bias failure 
test case. Again, this is to be expected because of the higher dynamic 
pressure. The steady-state magnitude of the elevator decision function 
is approximately the same as for the nominal flight condition failure 
test case. 

5.4.3 Right Aileron Failure Test Case 

The decision functions for a 0.0873 rad (5 deg) right aileron bias 

failure at the nominal cruise flight condition test case are shown in 

Figure 5.17. The wing surface decision functions (DF , DF , DF , DF ) 

2 3 5 6 

become large quickly. As with the -0.0873 rad (-5 deg) elevator bias 
failure at the nominal flight condition test case, a detection threshold 
of 20,000 would allow detection of a failure within 2 s. Isolating the 
failure to the right aileron surface is more difficult. The isolation 
decision functions DF , DF , and DF are shown in Figure 5.18. If an 
isolation threshold of 100 was realistic, this failure could be correctly 
isolated. However, testing of right aileron failures in a variety of 
flight conditions would be required to determine if this isolation 
threshold is realistic. 

5.4.4 Rudder Failure Test Case 

The decision functions for a -0.0873 rad (-5 deg) rudder bias 
failure are shown in Figure 5.19. For the same magnitude failure, the 
decision functions produced by a rudder failure are much smaller than 
produced by the other surfaces. Apparently, the rudder has less effect 
on the motion of the aircraft than the other surfaces. If the same 
detection threshold was used for each of the decision functions, this 
rudder failure could not be detected. Based on the no-failure results 
presented in Section 5.3, the smallest detection threshold that could be 
possibly selected would be 5000. This assumes the aircraft is flying 
near the nominal flight condition, the aircraft is not flying in thunder- 
storm turbulence, the flaps are not deflected and the maneuvers presented 
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were the most severe normally attempted by commercial aircraft* However, 
in the no-failure test cases presented in Section 5.3, the rudder deci- 
sion function is always small* The rudder decision function, excluding 
the times the airspeed was in the neighborhood of 51.44 m/s (100 knots), 
is less than 200 except for the large flap deflection and the thunder- 
storm turbulence test cases* With some compensation for thunderstorm 
turbulence and large flap deflections, a detection threshold of 400 for 
only the rudder decision function might be possible. If so, this rudder 
failure could be detected in approximately 3s* 

Isolation of this rudder failure is easy since the other decision 
functions are all less than 100* However, in general, isolation would 
have to be based simply on the magnitude of the rudder decision function 
since the decision functions of the other surfaces may be larger due to 
modeling errors. One approach would be to simultaneously detect and iso- 
late a rudder failure when the rudder decision function reaches the rud- 
der detection threshold. Since failures of other control surfaces also 
produce large rudder decision functions, a rudder failure should not be 
declared if another failure has already been detected. 

5*4*5 Right Flap Failure Test Case 

The decision functions for a 5% right flap failure test case are 
shown in Figure 5.20. For a detection threshold of 20,000, this failure 
would be detectable in 12 s. The failure would not be detectable for 
higher thresholds. As with the right aileron test case, isolating this 
failure to the correct wing surface may not be possible. Isolation deci- 
sion functions DF , DF , and DF are shown in Figure 5.21. If an 

DZ DO DO 

isolation threshold of a 100 was realistic, this failure could be isola- 
ted at the same time the failure was detected. Again, failure test cases 
at off-nominal flight conditions and wind conditions are required to de- 
termine realistic isolation thresholds. 
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5*4. 6 Largest Failure Decision Functions as a Function 

of Time and Failure Magnitude 

The purpose of testing the OSGLR algorithm with a number of fail- 
ure cases is to determine, for a given detection threshold, the size of 
the failures that can be detected and the time required for detection. A 
number of bias failures with the aircraft flying at the nominal flight 
condition were used to test the algorithm. The results were then plotted 
for each surface to readily answer the two questions raised. The largest 
values of the decision functions as a function of the size of the bias 
failure are plotted for each surface tested in Figures 5.22 - 5.25. Each 
figure contains five curves where each curve is for a particular time 
after the failure onset. For example, one curve describes the largest 
value of the decision functions 1 s after the failure. The symbols and 
their corresponding times after the failure onset are defined in Table 
5.4. The symbols correspond to actual test results. Considering the 
decision functions for only the first 15 s following a bias failure is 
sufficient because the decision functions, in most cases, grow slowly if 
at all after this. Since only a few bias failure cases for each surface 
were tested, the curves are approximate. 

In addition, the elevator and rudder plots only considers negative 
bias failures, and the right aileron plot only considers positive bias 
failures. Yet, one might expect the plots to be approximately the same 
for failures with opposite signs but the same magnitude. 

First consider elevator, right aileron, and right flap failures. 
Excluding the 75% and full flap deflection and the acceleration from 
51.44 m/s (100 knots) test cases, the largest value of the decision func- 
tions for the off-nominal flight conditions have been less than 10,000. 
Therefore, selecting a threshold of 20,000 might be reasonable at least 
for some flight regimes. Based on Figure 5.22, -0.0524 rad (-3 deg) 
elevator bias failures should be detectable with a 20,000 threshold. 
Similarly, 0.0436 rad (2.5 deg) right aileron and 5% right flap bias 
failures should be detectable. These bias failures would take 10 to 15 s 
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Size of elevator bias failure 
degrees ( radians) 

Figure 5.22 The largest decision function values 
produced by elevator bias failures 








00 


Figure 


2.00 

(0.0345) 


4.00 

(0.0698) 


6.00 

(0.1047) 


8.00 

(0.1396) 


10.00 

(0.01745) 


Size of right aileron bias failure 
degrees (radians) 

.23 The largest decision function values 

produced by right aileron bias failures 


- 108 - 






00 


20.00 


25.00 


30.00 



5.00 


10.00 15.00 


Size of right flap bias failure (percent) 

Figure 5.24 The largest decision function values produced 
by right flap bias failures 
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Table 5*4 Symbols for time after onset of bias failure 


Symbol 

Time After Onset of Bias Failure 

0 

1 sec 

A 

2 sec 

♦ 

5 sec 

X 

10 sec 

❖ 

1 5 sec 






to detect. However, -.1222 rad (-7 deg) elevator, 0.1571 rad (9 deg) 
right aileron, and 21% right flap bias failures, should be detectable in 
approximately 1 s. Ignoring thunderstorm turbulence, a threshold of 
10,000 would be reasonable. With this threshold, a -0.0873 rad (-5 deg) 
elevator bias failure, a 0.1134 rad (6.5 deg) right aileron bias failure, 
and a 15% right flap bias failure could be detected in Is. 

In the rudder bias failure test case discussion, a separate detec- 
tion threshold for the rudder decision function of 400 was motivated. 

This threshold may be reasonable for some operating envelope about the 
nominal flight condition that excludes thunderstorm turbulence and large 
flap deflections. With this threshold, a -0.07 rad (-4 deg) bias failure 
should be detected in approximately 15 s and a -0.1396 rad (-8 deg) bias 
failure in approximately 1 s. 

As detection thresholds will be selected to minimize false alarms, 
the size of the decision functions produced by off-nominal, no-failure 
flight conditions will determine the thresholds. Since these plots ap- 
proximately define the detection performance or a given detection thresh- 
old, they help determine the off-nominal flight conditions for which the 
decision functions need to be reduced to achieve acceptable performance. 

While these figures are only for bias failures, they still might 
be of use to estimate the detectability of other failures whose failure 
modes can be reasonably approximated by a bias failure. For example, a 
failure that ramps at 0.01745 rad/s (1 deg/s) to a bias failure of 0.0873 
rad (5 deg) will produce larger decision functions than a 0.0873 rad (5 
deg) failure that occurs 5 s after the ramp-to-a-bias failure. 

It should be emphasized that Figures 5.22 - 5.25 are only valid in 
a neighborhood of the nominal airspeed of 77.2 m/s (150 knots). At lower 
airspeeds, the decision functions are likely to be smaller for the same 
magnitude failure as less aerodynamic forces are produced for the same 
deflection. Similarly, the decision functions are likely to be larger 
for the same magnitude failure at higher airspeeds. 
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Similar plots of the smallest failure isolation decision functions 

as a function of the time after failure and the failure magnitude can be 

used to determine the isolation performance. In Figure 5.26, the minimum 

of the isolation decision functions DF ^ r DF , DF , DF , and DF are 

12 13 14 15 16 

plotted for two elevator bias magnitudes of -0.01745 rad (-1 deg) and 
-0.0873 rad (-5 deg). Approximate curves for the minimum of these isola- 
tion decision functions for five times after the failure onset are also 
shown in the figure. No effort was made to define what might be reason- 
able isolation thresholds. Yet, even small failures on the order of 
0.045 rad (2.58 deg) should be easily and quickly isolated. 

The minimum of the isolation decision functions DF_ , DF^, DF 

21 23 24 

DF . and DF are plotted for the right aileron bias failure test cases 
ZD Zb 

in Figure 5.27. Even for a small isolation threshold of 100, only 0.07 
rad (4 deg) and larger bias failures that can be isolated. The OSGLR 
algorithm might be able to quickly isolate large right aileron failures 
if an isolation threshold of 500 was reasonable. 

The minimum of the isolation decision functions for the right flap 

bias failure test case DF , DF C _, DF r _, DF_. and DF_ are plotted in 

5 i 52 53 54 56 

Figure 5.28. While larger than the minimum of the isolation decision 
functions for the right aileron failures, an isolation threshold of less 
than 400 would be required to isolate 10% and smaller bias failures. 

No figure for the rudder bias failure test cases is shown because 
there might be circumstances where a rudder failure would be detected and 
isolated even though the decision functions for the other surfaces are 
larger due to an off-nominal flight condition. The detection and isola- 
tion of a rudder failure would be based simply on the rudder decision 
function unless another failure has already been detected. 

5.5 Summary and Conclusions 

The OSGLR algorithm, based upon the linear model developed for the 
nominal cruise flight condition of 77.2 m/s (150 knots) at 304.8 m 
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Figure 5.28 The smallest of the isolation decision functions 
DF 5i (i r 5) produced by right flap bias failures 
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(1000 ft), was tested with sensor errors and dynamics at a number of 
off-nominal flight conditions. These off-nominal flight conditions 
included maneuvers, nonzero flap deflections, off-nominal turbulence 
intensity levels, and steady winds. Also, a number of bias failures were 
tested. Based on these tests, the following conclusion have been made. 

o Sensor errors and dynamics have a negligible effect on the 
performance of the OSGLR algorithm. 

o Including thrust as an input to the linear model reduces the 
mismodeling caused by off-nominal thrust. 

o Mismodeling increases as the actual dynamic pressure diverges 
from the nominal dynamic pressure. 

o The 77.2 m/s (150 knot) linear model is not valid for large 
(75% and greater) flap deflections. The decision functions 
produced by these flap deflections were 50,000 and larger. The 
same linear model also had difficulty in the neighborhood of 
51.44 m/s (100 knots) and slower. In one case, the decision 
functions produced in this low airspeed environment were almost 
40,000. Setting thresholds to accommodate these large decision 
functions would result in fair to poor FDI performance. For 
example, a threshold of 60,000 could detect a -0.1571 rad 
(-9 deg) elevator bias failure, a 0.1396 rad (8 deg) right 
aileron bias failure, and a 20% right flap bias failure in 2 
s. Yet, flap deflection greater than 75% would still produce 
false alarms with this threshold. 

o The cruise linear model was adequate for maneuvering flight. 
Ignoring airspeeds in the neighborhood of 51.44 m/s (100 knots) 
for which the linear model is not valid, the largest decision 
function produced by maneuvering flight was 4500 for the maxi- 
mum rate-of -climb test case. Therefore, a threshold of 10,000 
in the neighborhood of 77.2 m/s (150 knots) and excluding 
larger flap deflections should provide excellent false alarm 
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performance. With this threshold, a -0.0873 rad (-5 deg) 
elevator bias failure, a 0.1134 rad (6.5 deg) right aileron 
bias failure, and a 15% right flap bias failure could be 
detected in Is. A -0.0611 rad (-3.5 deg) elevator bias 
failure, a 0.0611 rad (3.5 deg) right aileron bias failure, and 
an 8% right flap failure could be detected in 2s. 

o Light turbulence of intensity 0.3 m/s (1 ft/s) and steady winds 
did not significantly effect the performance of the OSGLR 
algorithm. Thunderstorm turbulence of intensity of 6.4 m/s (21 
ft/s) may possibly cause decision functions on the order of 
6,000 to 8,000 when the aircraft is flying at the nominal 
cruise flight condition. Thunderstorm turbulence combined with 
maneuvers will most likely produce decision functions greater 
them 10,000. Some compensation for thunderstorm turbulence may 
be desirable. 

o A separate detection threshold is required for the rudder deci- 
sion function. A rudder failure produces a rudder decision 
function several orders of magnitude smaller than the same 
magnitude elevator and aileron failures. Therefore, if the 
same detection threshold used for the other surface was also 
used for the rudder, rudder failures would not be detectable. 
Fortunately, the rudder decision function is much smaller than 
the other decision functions in the off-nominal, no-failure 
cases tested. A detection threshold of 400 for the rudder 
decision function appears reasonable if low airspeeds in the 
neighborhood of 51.44 m/s (100 knots), large flap deflections, 
and thunderstorm turbulence are excluded. With this threshold, 
-0.1396 rad (-8 deg) rudder bias failure can be detected in 1 
s, a -0.1047 rad (-6 deg) bias failure in 2 s and a -0.0648 rad 
(-4 deg) in 10 to 15 s. 
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o Isolation of elevator failures should be straightforward* It 
may be possible to isolate large aileron and flap failures with 
the OSGLR algorithm* Failure test cases at off-nominal flight 
conditions are required to define adequate isolation thresholds 
for the ailerons and the flaps* Rudder failures should be 
simultaneously detected and isolated when the rudder decision 
function reaches the rudder detection threshold unless another 
failure has already been detected* 

The next section will examine reducing the decision function pro- 
duced at off-nominal dynamic pressures and nonzero flap deflections* 
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SECTION 6 


SCHEDULING 


6.1 Introduction 

Airspeeds of 51.44 m/s (100 knots) and less and flap deflections 
of 75% and greater were shown in Section 5 to produce large no-failure 
decision functions with an OSGLR algorithm based on the 77.2 m/s (150 
knots) cruise linear model. The large decision functions are due to the 
fact that the 11.2 m/s cruise linear model does not adequately character- 
ize these off-nominal flight conditions. The scheduling of the linear 
models of the aircraft, the steady-state age-weighted filter gain and 
covariance matrices, and the steady-state OSGLR influence and information 
matrices is considered in this section as a means of reducing these 
mismodeling effects. 1 First, a simple approach of scheduling zero flap 
deflection linear models only is described and tested with no-failure 
cases. Scheduling for nonzero flap deflections is then examined. The 
effect of scheduling only the linear models on the detection of failures 
is also briefly investigated. Finally, the scheduling of the 
age-weighted filter and OSGLR matrices in addition to the linear models 
is discussed. 

6.2 Scheduling of Zero Flap Deflection Linear Models 

Mismodeling was found in Section 5 to increase as the dynamic 
pressure deviated more from the nominal value. Scheduling only the 


1 A summary of the test cases is presented in Appendix A for easy 
reference and comparison. 
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linear models used by the age-weighted filter as a function of dynamic 
pressure was investigated as a means of reducing this mismodeling. (See 
Appendix B for further details.) By reducing the effects of mismodeling 
as reflected in the residual of the age-weighted filter, the no-failure 
decision functions should also be reduced. A linear model is chosen for 
use to minimize the ratio 


q - 


V 



where q is the actual dynamic pressure and q^ 

i 

pressure of the ith linear model. 


is the nominal dynamic 


Three linear models corresponding to cruise flight conditions at 
304.8 m (1000 ft) for airspeeds of 51.44 m/s (100 knots), 77.2 m/s (150 
knots), and 102.9 m/s (200 knots) were developed to test this simple 
scheduling approach. Using these linear models, the scheduling approach 
was tested on the acceleration from 51.44 m/s test case. The decision 
functions for this test case with the age-weighted filter and OSGLR 
steady-state matrices corresponding to the 77.2 m/s linear model are 
shown in Figure 6.1. The decision functions for the same test case with 
no scheduling of the linear model are shown in Figure 5.5. The decision 
functions are reduced by the scheduling approach except in the neighbor- 
hood of 77.2 m/s (41 s) with the maximum decision function levels reduced 
from 39,000 to 11,500. One possible reason the decision functions are 
still large at the beginning of the test case is that the dynamic 
pressure drops 57% below the nominal value of the 51.44 m/s linear model 
in the first several seconds. (As mentioned earlier, this drop in 
dynamic pressure is caused mainly by a large turbulence level and also by 
the control surfaces moving to control the aircraft as the control system 
starts up). Another linear model with nominal airspeed less than 51.44 
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Figure 6.1 Decision functions produced by an age-weighted, 
scheduled OSGLR algorithm for the acceleration 
from 51.44 m/s test case 

• 51.44, 77.2, 102.9 m/s linear models 

• 77.2 m/s age-weighted filter and OSGLR 
steady-state matrices 


- 122 - 



m/s may reduce the decision functions at the beginning of the test case 
further. 


Finding a steady-state cruise flight condition at low speeds about 
40 m/s (77.75 knots) with no flap deflection was not possible as the 
angle of attack required exceeded the validity of the simulation. 

Instead, a linear model corresponding to a cruise flight condition of 
46.3 m/s (90 knots) at 304.8 m (1000 ft) was developed and tested. Using 
the 46.3 ra/s linear model as the fourth model with the age-weighted 
filter and OSGLR steady-state matrices corresponding to the 77.2 m/s 
linear model produced the decision functions shown in Figure 6.2. Even 
though the dynamic pressure for the 46.3 m/s model (1274.6 N/m 2 or 
26.62 lbs/ft 2 ) was not significantly lower than the dynamic pressure 
for the 51.44 m/s model (1573.8 N/m 2 or 32.87 lbs/ft 2 ), adding the 
46.3 m/s linear model was sufficient to reduce the decision functions 
from 11,500 to 3,500 during the first 1 5 s of the test case. The largest 
decision function levels are reached at approximately 20 s when the age- 
weighted filter switches from the 51.44 m/s linear model to the 77.2 m/s 
linear model. 

Another reason that the decision functions are not reduced even 
more at low speeds is that the 51.44 m/s linear model does not as accu- 
rately describe the aircraft dynamics at its nominal flight condition as 
well as the 77.2 m/s linear model characterizes the 77.2 m/s cruise 
flight condition. The decision functions for a no-failure test case with 
the aircraft flying at 51.44 m/s and 304.8 m using the 51.44 m/s linear 
model and associated steady-state Kalman filter and OSGLR matrices (no 
age-weighting) are shown in Figure 6.3. These decision functions are 
significantly larger than the decision functions for a no-failure test 
case at 77.2 m/s with the 77.2 m/s linear model and associated Kalman 
filter and OSGLR steady-state matrices (no age-weighting) shown in Figure 
6.4. Either the nonlinearities are much greater at slow airspeeds and 
high angles of attack or the linear model needs improvement to better 
describe the aircraft dynamics. Even with this large mismodeling, the 
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Figure 6.2 Decision functions produced by an age-weighted, 
scheduled OSGLR algorithm for an acceleration 
from 51.44 m/s test case 

• 46.3, 51.44, 77.2, 102.9 m/s linear models 

• 77.2 m/s age-weighted filter and OSGLR 
steady-state matrices 
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51*44 m/s model used with an age-weighting of time constant 3 s is ade- 
quate to reduce the effects of mismodeling for the acceleration from 
51.44 m/s test case. Some effort was made to determine why the mismodel- 
ing is larger for the 51.44 m/s linear model in the limited time avail- 
able but without success. 

Despite the inadequacy of the 51.44 m/s linear model, scheduling 
of only the linear models used by the age-weighted filter was effective 
in reducing the decision functions at off-nominal dynamic pressures. 

6.3 Nonzero Flap Deflections 

Flap deflections of 75% and larger were shown in Section 5 to pro- 
duce very large no-failure decision functions using only the 77.2 m/s 
linear model* The scheduling of zero-flap linear models as discussed in 
the previous subsection actually increases the no-failure decision func- 
tions. The decision functions for a 50% flap deflection test case with 
the scheduling of the 46.3, 51.44, 77.2, and 102.9 m/s linear models and 
the age-weighted filter and OSGLR steady-state matrices corresponding to 
the 77.2 m/s model are shown in Figure 6.5. The flaps are deflected 
approximately 10%/s, starting at 5 s, until the desired deflection is 
achieved. Extending the flaps causes the airspeed to drop. With the 
scheduling of the linear models used by the age-weighted filter as a 
function of dynamic pressure, linear models more accurate at low 
airspeeds than the 77.2 m/s model are used. Interestingly, as a result, 
the decision functions increase. The 77.2 m/s linear model, for some 
reason, is not as sensitive to the combination of the flaps extending and 
the airspeed dropping as the 51.44 m/s linear model is to the flaps 
extending. Similarly, scheduling with zero-flap deflection linear models 
does not help the 75% and 100% flap deflection test case. Scheduling 
based on flap deflection as well as dynamic pressure appears necessary. 

Using linear models of 38.6, 51.44, and 77.2 m/s with a nominal 
flap deflection of 50% and age-weighted filter and OSGLR steady-state 
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matrices corresponding to the 11.2 m/s with 50% flap linear model signi- 
ficantly reduced the decision functions for the 50% and 75% test cases 
(Figures 6.6 and 6.7). The sudden increase in one of the decision func- 
tions in Figure 6.7 may be caused by a switch from the 77.2 m/s to the 
51.44 m/s models. The decision functions for the 100% flap test case 
using the 50% flap linear models, however, were larger than with the 
zero-flap deflection linear models. Using linear models with 100% nomi- 
nal flap deflection to reduce the decision functions for the 100% flap 
test was also briefly investigated without success (Figure 6.8). More 
effort is required, though, to determine why scheduling the 100% flap 
linear models was not adequate for the 100% flap test case. Also, the 
transition from zero to nonzero flap deflections still needs to be test- 
ed. 


6.4 Failure Detection and Scheduling 

The scheduling of linear models has been generally effective in 
reducing the effects of mismodeling on the no-failure decision func- 
tions. Detecting failures with the linear models scheduled is briefly 
considered here. Two failures at off-nominal flight conditions are pre- 
sented. The first case is a -0.0873 rad (-5 deg) elevator failure at a 
cruise flight condition of 90.0 m/s (175 knots). The decision functions 
for this test case with the linear models scheduled and the 77.2 m/s 
Kalman filter and OSGLR steady-state matrices are shown in Figure 6.9. 
The failure causes a decrease in dynamic pressure and therefore a switch 
from the 102.9 m/s linear model to the 77.2 m/s linear model 5 s after 
the failure occurred. The change of linear models does not cause any 
noticeable change in the decision functions. However, this is not true 
for the second case. 

The decision functions of a -0.0873 rad (-5 deg) elevator failure 
at a cruise flight condition of 64.3 m/s (125 knots) is shown in Figure 
6.10. For the first five seconds following the failure, the decision 
functions increase. However, when the linear model used by the age- 
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Figure 6.6 Decision functions produced by an age-weighted, 
scheduled OSGLR algorithm for a 50% flap 
deflection test case 

• 38.6, 51.44, 77.2 m/s with 50% flap 
linear models 

• 77.2 m/s with 50% flap age-weighted filter 
and OSGLR steady-state matrices 
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Figure 6.7 


Decision functions produced by an age-weighted, 
scheduled OSGLR algorithm for a 75% flap 
deflection test case 


• 38.6, 51.44, 77.2 xn/s with 50% flap 
linear models 

• 77.2 m/s with 50% flap age-weighted filter 
and OSGLR steady-state matrices 
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Figure 6.8 Decision functions produced by an age-weighted, 
scheduled OSGLR algorithm for a 100% flap 
deflection test case 

• 100% flap deflection from the start of 
the test case 

• 38.6, 51.44, 77.2 m/s with 100% flap 
linear models 

• 77.2 m/s with 100% flap age-weighted filter 
and OSGLR steady-state matrices 
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Figure 6.9 Decision functions produced by an age-weighted, 
scheduled OSGLR algorithm for a -0.0873 rad 
(-5 deg) elevator bias failure at 90.0 m/s 
(175 knots) test case 

• 46.4, 51.44, 77.2, 102.9 m/s linear models 

• 77.2 m/s age-weighted filter and OSGLR 
steady-state matrices 
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Figure 6.10 Decision functions produced by an age-weighted, 
scheduled OSGLR algorithm for a -0.0873 rad 
(-5 deg) elevator bias failure at 64.3 m/s 
(125 knots) test case 

• 46.4, 51.44, 77.2, 102.9 m/s linear models 

• 77.2 m/s age-weighted filter and OSGLR 
steady-state matrices 
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weighted filter switches from the 77.2 m/s model to the 51.44 m/s model 
because the dynamic pressure has decreased , the decision functions 
decrease signf icantly . The decision functions increase again when the 
dynamic pressure increases and the 77.2 m/s model was used again. Two 
possible reasons for this undesirable behavior are that the 51.44 m/s 
linear model is inadequate or that the 77.2 m/s age-weighted filter and 
OSGLR steady-state matrices are not appropriate for the 51.44 m/s linear 
model. The second possibility is eliminated as a reason for the decrease 
in the decision functions in the following subsection on scheduling of 
the age-weighted filter and OSGLR steady-state matrices. The 51.44 m/s 
linear model was shown in Section 6.2 not to model the 51.44 m/s cruise 
flight condition well so the first reason is the probable explanation. 

6.5 Scheduling of Age-Weighted Filter and OSGLR Steady-State Matrices 

Scheduling the linear models used by the age-weighted filter while 
assuming constant age-weighted filter and OSGLR steady-state matrices is 
unlikely to be acceptable over an entire flight envelope. Therefore, the 
scheduling of the steady-state age-weighted filter gain and residual 
covariance matrices as well as the steady-state OSGLR influence and 
information matrices was also investigated. (See Appendix B for more 
details.) The simple scheduling approach used for the linear models was 
employed (see Section 6.2). 

The decision functions for the -0.0873 rad (-5 deg) elevator fail- 
ure at 64.3 m/s (125 knots) is shown in Figure 6.11. There are several 
discontinuities in the decision functions due to changes in the steady- 
state information matrix used to calculate the decision functions. In 
fact, the elevator decision function jumps to 1.8 x 10 6 . A smaller 
vertical scale was chosen to show that even with the correct 51.44 m/s 
age-weighted filter and OSGLR steady-state matrices, the decision func- 
tions decay to very small values with the 51.44 m/s linear model. As 
discussed in the last subsection, the most probable reason for this unde- 
sirable behavior is a poor 51.44 m/s linear model. 
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The discontinuities resulting from changes in the steady-state in- 
formation matrix reveal the difficulty with the simple approach of sched- 
uling the steady-state information matrix. Using the simple scheduling, 
the linear model as well as the age-weighted filter and OSGLR steady- 
state matrices all change at the same time. The difficulty is that the 
steady-state information matrix is not valid for the old linear model, 
age-weighted filter matrices, and the OSGLR influence matrix, all of 
which were used to produce the information vectors up to the time of the 
switch of models. In order to avoid this difficulty, one might simply 
use a constant information matrix. However, in implementing this algo- 
rithm over an entire flight envelope, some change in the information 
matrix will most likely be required. 

Another scheduling approach of linearly interpolating between the 
linear models and their associated age-weighted filter and OSGLR matrices 
based upon the actual dynamic pressure was tried. The decision functions 
for the -0.0873 rad (-5 deg) elevator failure at 90.0 m/s (175 knots) 
test case for this scheduling is shown in Figure 6.12. The effect of 
turbulence on the dynamic pressure can be seen in the elevator decision 
function. The dynamic pressure could be smoothed, however. Still, this 
scheduling approach is not very satisfactory either. The elevator deci- 
sion function for this test case after the failure occured using the 77.2 
m/s model and associated steady-state age-weighted filter and OSGLR 
matrices is approximately 55,000. For the 102.9 m/s model and associated 
steady-state age-weighted filter and OSGLR matrices, the elevator deci- 
sion function is approximately 130,000. For the linear scheduling of the 
steady-state information matrix to have validity, one would expect the 
elevator decision functions to be within the range of 55,000 to 130,000. 
Instead, the elevator decision function is much larger. Scheduling the 
steady-state information matrix probably will not be satisfactory when- 
ever the linear model, age-weighted filter gain and covariance matrices 
and OSGLR influence matrix are changing. Therefore, the information mat- 
rix probably needs to be time-varying. 
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OSGLR algorithm 
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6.6 


Summary and Conclusions 


Scheduling of the linear models used by the age-weighted filter as 
a function of dynamic pressure was investigated as a means of reducing 
the mismodeling effects in the residuals of the filter and, therefore, 
reducing the no-failure decision functions. The age-weighted filter 
steady-state gain and covariance matrices and the OSGLR steady-state in- 
fluence and information matrices were assumed to be constant and corre- 
sponded to one of the linear models scheduled* The scheduling approach 
simply selected the linear model whose dynamic pressure was closest to 
the actual dynamic pressure* Using this scheduling approach, the deci- 
sion functions produced by the acceleration from 51.44 m/s test case were 
reduced from 39,000 to 6,000. This reduced decision function levels are 
comparable to the decision function levels produced by a maximum rate- 
of-climb maneuver. Further reductions are possible if a more accurate 
51.44 m/s linear model can be developed. 

Scheduling linear models as a function of dynamic pressure actual- 
ly increased the decision function produced by nonzero flap deflections 
in some cases. As these no-failure decisions are large, scheduling on 
flap deflection is also necessary. Using linear models with a nominal 
flap deflection of 50% reduced the decision functions for the 50% and 75% 
flap deflection test cases to less than 3,000. (The age-weighted filter 
and OSGLR steady-state matrices corresponded to one of the 50% flap 
linear models.) However, the decision functions produced by 100% flap 
deflection test case were very large even with the 50% flap linear 
models. Using linear models with a nominal flap deflection of 100% did 
not reduce the decision function levels for the 100% flap test case 
either. More effort is required to explain why scheduling 100% flap 
linear models was not sufficient to reduce the decision functions 
produced by the 100% flap test case. 

Two off-nominal elevator failure cases were tested with the linear 
models scheduled. One case showed no difficulty in detecting the failure 
with the scheduling. The other case further demonstrated the need for a 
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better 51.44 m/s linear model. Further testing of failure cases is re 
quired to determine the effect of scheduling only the linear models on 
detecting and isolating failures. 

The scheduling of the age-weighted filter steady-state gain and 
residual covariance matrices and the OSGLR steady-state influence and 
information matrices was also briefly investigated. Some scheduling of 
these matrices will be necessary for the OSGLR algorithm to be extended 
over the entire flight envelope. Two scheduling approaches were tested: 
the simple approach described earlier and linear interpolation. The same 
scheduling approach was used for both the linear model and the age- 
weighted filter and OSGLR steady-state matrices. The results from sever- 
al failure cases using both scheduling approaches suggested that time- 
varying information matrix may be required. 

The information matrix reflects the uncertainty in the information 
vector. The two scheduling approaches assume the change in uncertainty 
in the information vector caused by the change in the filter gain and 
residual covariance matrices and the OSGLR influence matrix is instantan- 
eous. However, there is a time lag before the effect of the changes in 
the gain, covariance, and influence matrices is reflected in the informa- 
tion vector. Further work is needed to define the extent of the schedu- 
ling required for the age-weighted filter gain and residual covariance 
matrices and the OSGLR influence matrix. 
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SUMMARY AND CONCLUSIONS 


This report has evaluated the orthogonal series generalized like- 
lihood ratio (OSGLR) test for detecting and isolating commercial aircraft 
control surface and actuator failures. The OSGLR algorithm was chosen 
based on a preliminary evaluation of three failure detection and isola- 
tion (FDI ) algorithms: the detection filter, the generalized likelihood 
ratio test, and the OSGLR test. The OSGLR test offered the best perfor- 
mance with moderate computational requirements. However, the OSGLR algo- 
rithm was also more to sensitive to modeling errors than the other two 
algorithms. This preliminary evaluation is summarized in Section 2* In 
addition, FDI algorithms are surveyed in Section 3 searching for addi- 
tional practical techniques that might be applicable for Res tructur able 
Controls. The most promising algorithms appeared to be those already 
considered and, therefore, the effort concentrated on the OSGLR algo- 
rithm. 


For the OSGLR algorithm to be feasible, it was necessary to im- 
prove its robustness to model uncertainty. Methods of improving the ro- 
bustness of the algorithm were examined with the incorporation of age- 
weighting into the algorithm being the most effective approach, signifi- 
cantly reducing the sensitivity of the algorithm. With age -weigh ting, 
the covariance of the past measurements and residuals is increased, caus- 
ing the algorithm to rely more on the new measurements than the past mea- 
surements. 

In the preliminary evaluation, the algorithms were tested basical- 
ly at the nominal cruise flight condition of 77.2 m/s (150 knots) at 
304.8 m (1000 ft). In this more in-depth evaluation, a number of no- 
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failure test cases at off-nominal flight conditions including maneuvers, 
nonzero flap deflections, different turbulence levels and steady winds 
were used to test the OSGLR algorithm. Maneuvering flight typical of 
commercial aircraft near the nominal dynamic pressure, light and nominal 
turbulence levels, and steady winds did not produce significant no- 
failure decision functions. Large (75% and greater) flap deflections and 
airspeeds of 51 m/s (100 knots) and less produced large no-failure deci- 
sion functions. The 77.2 m/s (150 knots) cruise linear model was not 
valid for these flight conditions. 

Since detection thresholds will be chosen such that false alarms 
are improbable, the no-failure decision functions produced by the off- 
nominal flight conditions determine the realistic detection thresholds 
possible in the neighborhood of the nominal flight condition. The detec- 
tion performance was examined by running a number of failure test cases, 
mostly at the nominal flight condition. For maneuvering flight near the 
nominal dynamic pressure, small flap deflections, light and nominal tur- 
bulence levels, and steady wind, selecting a threshold to detect 5 deg 
elevator, 7 deg aileron, 8 deg rudder, and 15% flap bias failures in 1 s 
at 77.2 m/s (150 knots) appears possible. If there is no compensation 
for thunderstorm turbulence, a larger detection threshold would be re- 
quired resulting in slightly worse detection performance. 

Finally, extending the validity of the algorithm to off-nominal 
airspeeds and large flap deflection flight conditions by scheduling was 
considered. The approach investigated was to schedule the linear models 
used by the age-weighted filter, choosing the linear model with the 
nominal dynamic pressure closest to the actual dynamic pressure. The 
steady-state age-weighted filter and OSGLR matrices corresponded to one 
of the linear model scheduled. Scheduling on dynamic pressure was used 
because modeling errors increased with increasing off-nominal dynamic 
pressure. This approach successfully reduced the no-failure decision 
functions produced at low airspeeds. Scheduling on flap deflection was 
also investigated with some success to reduce the no-failure decision 
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functions produced by large flap deflections. Since simply scheduling 
the linear models over the entire flight envelope of a commercial air- 
craft is unlikely to be adequate, scheduling of the age-weighted filter 
gain and covariance steady-state matrices and the OSGLR influence and in- 
formation steady-state matrices in the same manner as the linear models 
was briefly investigated. The scheduling of the steady-state information 
matrix was unsatisfactory; a time-varying information matrix may be re- 
quired. Scheduling of the linear model matrices , the age-weighted filter 
gain and covariance steady-state matrices, and the OSGLR influence 
steady-state matrix, however, appears feasible. 

Depending on the requirements of restructuring the control system, 
the OSGLR algorithm should be capable of detecting aircraft control sur- 
face failures for Res true tur able Controls application. Moderate and 
large failures can be detected quickly. Small failures require longer 
detection times or cannot be detected. However, failures that are diffi- 
cult to detect may not be important and could be partially compensated 
for by a control system robust to small control surface failures. Isola- 
tion of some failures may be difficult if there are several surfaces 
which produce similar effects on the aircraft. Even for these surfaces, 
isolation may be possible if the failure is moderate or large. If re- 
structuring the control system requires isolation for all failures, posi- 
tion sensors on some of the surfaces will most likely be required. 
Finally, extending the algorithm over the entire operating envelope of a 
commercial aircraft, while not demonstrated, appears feasible based on 
the experience of extending the algorithm to a number of flight condi- 
tions. 

Further investigation of the scheduling of the linear models and 
the implementation of the OSGLR algorithm is required, though, before the 
algorithm can be extended over the entire envelope. Some of the issues 
requiring consideration are: 

o the number of linear models required to cover the entire flight 
envelope. 
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o the complexity of the implementation approach versus 
performance* 

• Is the steady-state implementation of the OSGLR 
algorithm (except for the information matrix) 
adequate or is the time-varying implementation 
necessary? 

• Are there significant performance benefits to a 
time-varying implementation? 

• If scheduling is adequate, how much scheduling of the 
age-weighted filter gain and covariance matrices and 
the OSGLR influence matrices is required? 

o the computational and storage requirements of the different 
approaches. 

• Can the requirements be reduced by, for example, 
fitting scheduled matrices? 

These issues are important since there is not much experience in imple- 
menting multivariable systems for practical real-time use. 
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APPENDIX A 


SUMMARY OF TEST CASES 


This appendix contains a table (Table A-1 ) summarizing the test 
cases presented in this report for easy reference and comparison* Only 
the steady-state implementation of the OSGLR algorithm was tested* In 
addition, all the test cases included the effects of sensor noise, 
errors, and dynamics* 
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Table A-1 Summary of Test Cases 


Scheduling 

Approach 
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Table A-1 Summary of Test Cases (Cont.-6) 
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APPENDIX B 


SCHEDULING IMPLEMENTATION DETAILS 


B.1 Introduction 

This appendix describes in more detail the scheduling considered 
in this report. First, the linear model formulation and the OSGLR 
steady-state equations will be presented and then the scheduling of the 
linear models and OSGLR steady-state algorithm described. 

B.2 Linear Model Formulation 

The continuous-time linear model can be written 

Ax = f(x , u ) + A Ax + BAx (B.1) 

- -o — o — — 

y = g(x r u ) + C Ax + DAu (B.2) 

- -o -o - - 

where 



x = 

f (x,u) 


(B.3) 


y = 

g(x,y) 


(B.4) 

are the nonlinear 

state differential 

and output 

equations. 

x and 
-o 

u are the nominal 
— o 

state and input vectors. Ax 

and Au are 

defined to be 


Ax = 

X - X 


(B.5) 



- -o 



Au = 

u - u 
-o 


(B.6) 
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An equivalent discrete-time linear model can be written 


Ax(k+1 ) = f (x t u ) + $Ax(k) + BAu(k) (B.7) 

- -a -o -o - — 

y(k) = g (x ,u ) + CAx(k) + DAu(k) (B.8) 

- -a -o -o - - 

where the matrix B now is the discrete state input matrix (consistent 
with Eq* (2*1 7) )• The discrete linear model may be rewritten as 

x(k+1) = $x(k) + Bu(k ) + g(k) (B.9) 

y(k) = Cx(k) + Du (k ) + h(k) (B.10) 

by using Eqs, (B.5) and (B«6)« The constant bias vectors/ g(k) and h(k) r 
are given by 


g(k) 

= f,(x ,u ) 

+ x - $x - Bu 

(Ball ) 


-d -o -o 

-o -o -o 

h(k) 

-a -o -o 

i 

0 

IX 

0 

1 

l§ 

0 

(B.12) 


B#3 Steady-State OSGLR Equations 

The steady-state OSGLR equations consist of the steady-state age- 
weighted filter equations and the OSGLR information vectors and decision 
function equations. 

The steady-state age-weighted filter equations are 


x~(k+1 ) 

= $x + (k) + Bu(k) + g(k) 

(B.13) 

x+(k) 

= x~(k) + Ky(k) 

(B.14) 

y(k) 

= y(k) - y(k) 

(B.15) 

y(k) 

= Cx(k) + Du(k) + h(k) 

(B.16) 
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The steady-state information vector equation is 


X(k+D = ^ A^x(k) + G T M -1 j(k+1 ) (B. 1 7) 

where s is the age-weighting constant, is the basis function 
transition matrix, G is the steady-state influence matrix, and M is the 
residual covariance matrix (with the effects of age-weighting included). 

The decision function is given by 


DF(k ) = x T (k) S _1 xOc) 


(B.18) 


where S is the steady-state information matrix. 

B.4 Scheduling 

The scheduling approach given the most consideration was the 
approach of scheduling the linear model used by the age-weighted filter 
( Eqs • B.13 and B.16) as a function of dynamic pressure. At each time 
step, the linear model whose nominal dynamic pressure was closest to the 
actual dynamic pressure was chosen. While scheduling of all the $, B, C, 
and D matrices and the jg and h_ vectors which represent the linear model 
may not be necessary in practice, this was the approach taken in this 
report. 

The scheduling of the steady-state age-weighted filter gain and 

residual covariance matrices (K and M respectively) and the steady-state 

OSGLR influence and information matrices (G and S respectively) was also 

briefly examined. Scheduling of the A^ matrix and the age-weighting 

factor s is not necessary as they remain constant. Actually, the product 
T -1 

G M found in Eq. B.17 was scheduled instead of scheduling the steady- 
state influence and residual covariance matrices (G and M) separately. 
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